CVE-2022-30788
📋 TL;DR
CVE-2022-30788 is a heap-based buffer overflow vulnerability in NTFS-3G's ntfs_mft_rec_alloc function. Attackers can exploit this by mounting a specially crafted NTFS image, potentially leading to arbitrary code execution or system crashes. This affects systems using NTFS-3G for NTFS filesystem access, particularly Linux/Unix systems that mount NTFS drives.
💻 Affected Systems
- NTFS-3G
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Ntfs 3g by Tuxera
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root privileges, allowing attackers to execute arbitrary code, install malware, or exfiltrate data.
Likely Case
System crash or denial of service when mounting malicious NTFS images, potentially leading to data corruption or system instability.
If Mitigated
Limited impact with proper access controls and monitoring; exploitation requires mounting malicious filesystems.
🎯 Exploit Status
Exploitation requires user interaction to mount malicious NTFS images; proof-of-concept code is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2021.8.22 and later (fixed in subsequent releases)
Vendor Advisory: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x
Restart Required: No
Instructions:
1. Update NTFS-3G to version 2022.5.17 or later. 2. For Linux distributions, use package manager: 'sudo apt update && sudo apt upgrade ntfs-3g' (Debian/Ubuntu) or 'sudo yum update ntfs-3g' (RHEL/CentOS). 3. Verify installation with 'ntfs-3g --version'.
🔧 Temporary Workarounds
Disable NTFS-3G mounting
linuxPrevent NTFS-3G from being used to mount NTFS filesystems
sudo chmod 000 /usr/bin/ntfs-3g
sudo chmod 000 /sbin/mount.ntfs-3g
Mount NTFS as read-only
linuxMount NTFS filesystems with read-only permissions to prevent exploitation
sudo mount -t ntfs-3g -o ro /dev/sdX1 /mnt/ntfs
🧯 If You Can't Patch
- Restrict user permissions to mount filesystems
- Implement application allowlisting to prevent execution of malicious NTFS images
🔍 How to Verify
Check if Vulnerable:
Check NTFS-3G version: 'ntfs-3g --version' or 'dpkg -l | grep ntfs-3g' or 'rpm -q ntfs-3g'. If version is 2021.8.22 or earlier, system is vulnerable.Check Version:
ntfs-3g --versionVerify Fix Applied:
Verify NTFS-3G version is 2022.5.17 or later using 'ntfs-3g --version'. Test mounting a known-safe NTFS image.📡 Detection & Monitoring
Log Indicators:
- Kernel logs showing NTFS-3G crashes
- System logs with 'ntfs-3g' process termination
- Unexpected filesystem mount attempts
Network Indicators:
- Unusual network transfers of NTFS image files
- SMB/NFS shares containing suspicious NTFS images
SIEM Query:
process_name='ntfs-3g' AND (event_type='crash' OR exit_code!=0)🔗 References
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x
- https://lists.debian.org/debian-lts-announce/2022/06/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JPX6OUCQKZX4PN5DQPVDUFZCOOZUX7Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECDCISL24TYH4CTDFCUVF24WAKRSYF7F/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FAXFYIJWT5SHHRNPOJETM77EIMJ6ZP6I/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEXHDCUSLJD2HSPMAAVZ5AWMPUOG6UI7/
- https://security.gentoo.org/glsa/202301-01
- https://www.debian.org/security/2022/dsa-5160
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x
- https://lists.debian.org/debian-lts-announce/2022/06/msg00017.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JPX6OUCQKZX4PN5DQPVDUFZCOOZUX7Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECDCISL24TYH4CTDFCUVF24WAKRSYF7F/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FAXFYIJWT5SHHRNPOJETM77EIMJ6ZP6I/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEXHDCUSLJD2HSPMAAVZ5AWMPUOG6UI7/
- https://security.gentoo.org/glsa/202301-01
- https://www.debian.org/security/2022/dsa-5160
