[Bug 2093314] New: CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value
https://bugzilla.redhat.com/show_bug.cgi?id=2093314
Bug ID: 2093314 Summary: CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: gsuckevi@redhat.com CC: ddepaula@redhat.com, epel-packagers-sig@lists.fedoraproject.org, jferlan@redhat.com, kparal@redhat.com, ngompa13@gmail.com, rjones@redhat.com, spotrh@gmail.com, virt-maint@redhat.com Target Milestone: --- Classification: Other
A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.
References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x https://github.com/tuxera/ntfs-3g/releases
https://bugzilla.redhat.com/show_bug.cgi?id=2093314
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2093315, 2093319, 2093317, | |2093318, 2093316
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2093315 [Bug 2093315] CVE-2022-30784 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2093316 [Bug 2093316] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2093317 [Bug 2093317] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2093318 [Bug 2093318] CVE-2022-30784 ntfs2btrfs: ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2093319 [Bug 2093319] CVE-2022-30784 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2093314
--- Comment #1 from Guilherme de Almeida Suckevicz gsuckevi@redhat.com --- Created ntfs-3g tracking bugs for this issue:
Affects: epel-all [bug 2093317] Affects: fedora-all [bug 2093316]
Created ntfs-3g-system-compression tracking bugs for this issue:
Affects: epel-all [bug 2093315] Affects: fedora-all [bug 2093319]
Created ntfs2btrfs tracking bugs for this issue:
Affects: fedora-all [bug 2093318]
https://bugzilla.redhat.com/show_bug.cgi?id=2093314
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2093356
https://bugzilla.redhat.com/show_bug.cgi?id=2093314 Bug 2093314 depends on bug 2093316, which changed state.
Bug 2093316 Summary: CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2093316
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=2093314 Bug 2093314 depends on bug 2093319, which changed state.
Bug 2093319 Summary: CVE-2022-30784 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2093319
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=2093314 Bug 2093314 depends on bug 2093317, which changed state.
Bug 2093317 Summary: CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2093317
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=2093314
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |ntfs-3g 2022.5.17
https://bugzilla.redhat.com/show_bug.cgi?id=2093314
--- Doc Text *updated* by Guilherme de Almeida Suckevicz gsuckevi@redhat.com --- A vulnerability was found in NTFS-3G. Incorrect validation of NTFS metadata can result in a heap exhaustion when processing a crafted NTFS image file or partition.
https://bugzilla.redhat.com/show_bug.cgi?id=2093314
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2127239, 2127236, 2127237, | |2127233, 2127235, 2127234, | |2127238
epel-packagers-sig@lists.stg.fedoraproject.org
-
bugzilla＠redhat.com