https://bugzilla.redhat.com/show_bug.cgi?id=2093358
Bug ID: 2093358 Summary: CVE-2021-46790 ntfs-3g: heap-based buffer overflow in ntfsck Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: gsuckevi@redhat.com CC: ddepaula@redhat.com, epel-packagers-sig@lists.fedoraproject.org, jferlan@redhat.com, kparal@redhat.com, ngompa13@gmail.com, rjones@redhat.com, spotrh@gmail.com, virt-maint@redhat.com Target Milestone: --- Classification: Other
ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2. NOTE: the upstream position is that ntfsck is deprecated; however, it is shipped by some Linux distributions.
References: https://github.com/tuxera/ntfs-3g/issues/16 http://www.openwall.com/lists/oss-security/2022/05/26/1
https://bugzilla.redhat.com/show_bug.cgi?id=2093358
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2093361, 2093359, 2093363, | |2093362, 2093360
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2093359 [Bug 2093359] CVE-2021-46790 ntfs2btrfs: ntfs-3g: heap-based buffer overflow in ntfsck [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2093360 [Bug 2093360] CVE-2021-46790 ntfs-3g: heap-based buffer overflow in ntfsck [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2093361 [Bug 2093361] CVE-2021-46790 ntfs-3g-system-compression: ntfs-3g: heap-based buffer overflow in ntfsck [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2093362 [Bug 2093362] CVE-2021-46790 ntfs-3g: heap-based buffer overflow in ntfsck [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2093363 [Bug 2093363] CVE-2021-46790 ntfs-3g-system-compression: ntfs-3g: heap-based buffer overflow in ntfsck [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2093358
--- Comment #1 from Guilherme de Almeida Suckevicz gsuckevi@redhat.com --- Created ntfs-3g tracking bugs for this issue:
Affects: epel-all [bug 2093362] Affects: fedora-all [bug 2093360]
Created ntfs-3g-system-compression tracking bugs for this issue:
Affects: epel-all [bug 2093363] Affects: fedora-all [bug 2093361]
Created ntfs2btrfs tracking bugs for this issue:
Affects: fedora-all [bug 2093359]
https://bugzilla.redhat.com/show_bug.cgi?id=2093358
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2093356
https://bugzilla.redhat.com/show_bug.cgi?id=2093358 Bug 2093358 depends on bug 2093360, which changed state.
Bug 2093360 Summary: CVE-2021-46790 ntfs-3g: heap-based buffer overflow in ntfsck [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2093360
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=2093358 Bug 2093358 depends on bug 2093361, which changed state.
Bug 2093361 Summary: CVE-2021-46790 ntfs-3g-system-compression: ntfs-3g: heap-based buffer overflow in ntfsck [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2093361
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=2093358 Bug 2093358 depends on bug 2093362, which changed state.
Bug 2093362 Summary: CVE-2021-46790 ntfs-3g: heap-based buffer overflow in ntfsck [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2093362
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=2093358
--- Doc Text *updated* by Guilherme de Almeida Suckevicz gsuckevi@redhat.com --- A vulnerability was found in NTFS-3G, specifically in the ntfsck utility. Incorrect validation of NTFS metadata can result in a heap-based buffer overflow when processing a crafted NTFS image file or partition.
https://bugzilla.redhat.com/show_bug.cgi?id=2093358
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |ntfs-3g 2022.5.17
https://bugzilla.redhat.com/show_bug.cgi?id=2093358
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2127263, 2127268, 2127265, | |2127264, 2127267, 2127262, | |2127266
epel-packagers-sig@lists.stg.fedoraproject.org
-
bugzilla＠redhat.com