Description
An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ntfs-3g | 1:2017.3.23AR.3-3 | — |
| Debian 13 | ntfs-3g | 1:2017.3.23AR.3-3 | — |
| Debian 12 | ntfs-3g | 1:2017.3.23AR.3-3 | — |
| Debian 9 | ntfs-3g | 1:2016.2.22AR.1+dfsg-1+deb9u1 | DSA-4413-1 |
| Debian 8 | ntfs-3g | 1:2014.2.15AR.2-1+deb8u4 | DLA-1724-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | ntfs-3g | 1:2017.3.23-2ubuntu0.18.04.1 | USN-3914-1 |
| Ubuntu 16.04 LTS | ntfs-3g | 1:2015.3.14AR.1-1ubuntu0.2 | USN-3914-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | ntfs-3g | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | SLOF | 20171214-6.gitfa98132.module+el8.1.0+4066+0f1aadab | RHSA-2019:3345, RHBA-2019:3723 |
| RHEL 8 | hivex +6 | 1.3.15-7.module+el8.1.0+3554+1a3a94a6 | RHSA-2019:3345, RHBA-2019:3723 |
| RHEL 8 | libguestfs-winsupport | 8.0-4.module+el8.1.0+3554+1a3a94a6 | RHSA-2019:3345, RHBA-2019:3723 |
| RHEL 8 | libiscsi +2 | 1.18.0-8.module+el8.1.0+3554+1a3a94a6 | RHSA-2019:3345, RHBA-2019:3723 |
| RHEL 8 | libtpms +1 | 0.6.1-0.20190121git9dc915572b.module+el8.1.0+3523+b348b848.2 | RHBA-2019:3723 |
| RHEL 8 | libvirt +27 | 4.5.0-35.module+el8.1.0+4227+b2722cb3 | RHSA-2019:3345, RHBA-2019:3723 |
| RHEL 8 | libvirt-daemon-driver-storage-iscsi-direct | 5.6.0-6.module+el8.1.0+4244+9aa4e6bb | RHBA-2019:3723 |
| RHEL 8 | libvirt-dbus | 1.2.0-3.module+el8.1.0+4066+0f1aadab | RHSA-2019:3345, RHBA-2019:3723 |
| RHEL 8 | libvirt-python +1 | 4.5.0-2.module+el8.1.0+4066+0f1aadab | RHSA-2019:3345, RHBA-2019:3723 |
| RHEL 8 | nbdkit +9 | 1.4.2-5.module+el8.1.0+4066+0f1aadab | RHSA-2019:3345, RHBA-2019:3723 |
| RHEL 8 | nbdkit-server +8 | 1.12.5-1.module+el8.1.0+3868+35f94834 | RHBA-2019:3723 |
| RHEL 8 | netcf +2 | 0.2.8-12.module+el8.1.0+3921+a49f7d7b | RHSA-2019:3345, RHBA-2019:3723 |
| RHEL 8 | perl-Sys-Virt | 4.5.0-5.module+el8.1.0+4066+0f1aadab | RHSA-2019:3345, RHBA-2019:3723 |
| RHEL 8 | qemu-img +10 | 15:2.12.0-88.module+el8.1.0+4233+bc44be3f | RHSA-2019:3345, RHBA-2019:3723 |
| RHEL 8 | seabios +2 | 1.11.1-4.module+el8.1.0+4066+0f1aadab | RHSA-2019:3345, RHBA-2019:3723 |
| RHEL 8 | sgabios +1 | 1:0.20170427git-3.module+el8.1.0+3554+1a3a94a6 | RHSA-2019:3345, RHBA-2019:3723 |
| RHEL 8 | supermin +1 | 5.1.19-9.module+el8.1.0+4066+0f1aadab | RHSA-2019:3345, RHBA-2019:3723 |
| RHEL 8 | swtpm +3 | 0.1.0-1.20190425gitca85606.module+el8.1.0+3966+4a23dca1.1 | RHBA-2019:3723 |
| RHEL 8 | virglrenderer +2 | 0.6.0-5.20180814git491d3b705.module+el8.1.0+3523+b348b848 | RHBA-2019:3723 |
| RHEL 8 | virt-dib +26 | 1:1.38.4-14.module+el8.1.0+4066+0f1aadab | RHSA-2019:3345, RHBA-2019:3723 |
| RHEL 7 | libguestfs-winsupport | 7.2-3.el7 | RHSA-2019:2308 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | libiscsi +2 | 1.18.0-8.module_el8.3.0+2048+e7a0a3ea | ALSA-2019:3345 |
| AlmaLinux 8 | netcf +2 | 0.2.8-12.module_el8.3.0+2048+e7a0a3ea | ALSA-2019:3345 |
| AlmaLinux 8 | sgabios | 1:0.20170427git-3.module_el8.3.0+2048+e7a0a3ea | ALSA-2019:3345 |
| AlmaLinux 8 | sgabios-bin | 1:0.20170427git-3.module_el8.5.0+2608+72063365 | ALSA-2019:3345 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | libiscsi | 1.18.0-8.module+el8.4.0+534+4680a14e | RLSA-2019:3345 |
| Rocky Linux 8 | netcf | 0.2.8-12.module+el8.4.0+534+4680a14e | RLSA-2019:3345 |
| Rocky Linux 8 | sgabios | 1:0.20170427git-3.module+el8.4.0+534+4680a14e | RLSA-2019:3345 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | ntfs-3g_ntfsprogs | 2021.8.22-3.8.1 | SUSE-SU-2021:2971-1 |
| SLES 15 SP2 | ntfs-3g_ntfsprogs | 2021.8.22-3.8.1 | SUSE-SU-2021:2971-1 |
| SLES 15 | ntfs-3g_ntfsprogs | 2016.2.22-3.3.2 | SUSE-SU-2019:1001-1 |
| SLES 12 SP5 | ntfs-3g_ntfsprogs | 2021.8.22-5.9.1 | SUSE-SU-2021:2965-1 |
| SLES 12 SP4 | ntfs-3g_ntfsprogs | 2013.1.13-5.6.1 | SUSE-SU-2019:1000-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | ntfs-3g_ntfsprogs | 2013.1.13-5.6.1 | SUSE-SU-2019:1000-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.3 | ntfs-3g_ntfsprogs | 2021.8.22-3.8.1 | openSUSE-SU-2021:2971-1 |
| openSUSE Leap 15.2 | ntfs-3g_ntfsprogs | 2021.8.22-lp152.5.3.1 | openSUSE-SU-2021:1244-1 |
| openSUSE Leap 15.0 | ntfs-3g_ntfsprogs | 2016.2.22-lp150.2.3.1 | openSUSE-SU-2019:1314-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | ntfs-3g | 2017.3.23-r2 | — |
| Alpine v3.23 | ntfs-3g | 2017.3.23-r2 | — |
| Alpine v3.22 | ntfs-3g | 2017.3.23-r2 | — |
| Alpine v3.21 | ntfs-3g | 2017.3.23-r2 | — |
| Alpine v3.20 | ntfs-3g | 2017.3.23-r2 | — |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | ntfs-3g | 2017.3.23-r2 | — |
| Alpine v3.18 | ntfs-3g | 2017.3.23-r2 | — |
| Alpine v3.17 | ntfs-3g | 2017.3.23-r2 | — |
| Alpine v3.16 | ntfs-3g | 2017.3.23-r2 | — |
| Alpine v3.15 | ntfs-3g | 2017.3.23-r2 | — |
| Alpine v3.14 | ntfs-3g | 2017.3.23-r2 | — |
| Alpine v3.13 | ntfs-3g | 2017.3.23-r2 | — |
| Alpine v3.12 | ntfs-3g | 2017.3.23-r2 | — |
| Alpine v3.11 | ntfs-3g | 2017.3.23-r2 | — |
| Alpine v3.10 | ntfs-3g | 2017.3.23-r2 | — |
| Alpine v3.9 | ntfs-3g | 2017.3.23-r2 | — |
| Alpine v3.8 | ntfs-3g | 2017.3.23-r2 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | libguestfs-winsupport | 7.2-3.amzn2 | ALAS2-2020-1522 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | ntfs-3g | 2017.3.23-15 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | hivex +6 | 1.3.15-7.module+el8.1.0+5378+c5e0f4d7 | ELSA-2019-3345 |
| Oracle Linux 8 | libguestfs-winsupport | 8.0-4.module+el8.1.0+5378+c5e0f4d7 | ELSA-2019-3345 |
| Oracle Linux 8 | libiscsi +2 | 1.18.0-8.module+el8.1.0+5378+c5e0f4d7 | ELSA-2019-3345 |
| Oracle Linux 8 | libvirt +27 | 4.5.0-35.0.1.module+el8.1.0+5378+c5e0f4d7 | ELSA-2019-3345 |
| Oracle Linux 8 | libvirt-dbus | 1.2.0-3.module+el8.1.0+5378+c5e0f4d7 | ELSA-2019-3345 |
| Oracle Linux 8 | nbdkit +9 | 1.4.2-5.module+el8.1.0+5378+c5e0f4d7 | ELSA-2019-3345 |
| Oracle Linux 8 | netcf +2 | 0.2.8-12.module+el8.1.0+5378+c5e0f4d7 | ELSA-2019-3345 |
| Oracle Linux 8 | perl-Sys-Virt | 4.5.0-5.module+el8.1.0+5378+c5e0f4d7 | ELSA-2019-3345 |
| Oracle Linux 8 | python3-libvirt | 4.5.0-2.module+el8.1.0+5378+c5e0f4d7 | ELSA-2019-3345 |
| Oracle Linux 8 | qemu-img +10 | 15:2.12.0-88.0.1.module+el8.1.0+5378+c5e0f4d7 | ELSA-2019-3345 |
| Oracle Linux 8 | seabios +2 | 1.11.1-4.module+el8.1.0+5378+c5e0f4d7 | ELSA-2019-3345 |
| Oracle Linux 8 | sgabios +1 | 1:0.20170427git-3.module+el8.1.0+5378+c5e0f4d7 | ELSA-2019-3345 |
| Oracle Linux 8 | supermin +1 | 5.1.19-9.module+el8.1.0+5378+c5e0f4d7 | ELSA-2019-3345 |
| Oracle Linux 8 | virt-dib +26 | 1:1.38.4-14.0.1.module+el8.1.0+5378+c5e0f4d7 | ELSA-2019-3345 |
| Oracle Linux 7 | libguestfs-winsupport | 7.2-3.el7 | ELSA-2019-2308 |
Advisories 19
- ALSA-2019:3345 Low: virt:rhel security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 5, 2026
- WID-SEC-2022-0517 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
- RHSA-2019:3345 Red Hat Security Advisory: virt:rhel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2019:2308 Red Hat Security Advisory: libguestfs-winsupport security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHBA-2019:3723 Red Hat Bug Fix Advisory: Advanced Virtualization bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- USN-3914-1 ntfs-3g vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-4413-1 ntfs-3g - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1724-1 ntfs-3g - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2019:3345 Low: virt:rhel security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
- openSUSE-SU-2021:1244-1 Security update for ntfs-3g_ntfsprogs SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1314-1 Security update for ntfs-3g_ntfsprogs SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:2971-1 Security update for ntfs-3g_ntfsprogs SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2971-1 Security update for ntfs-3g_ntfsprogs SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1000-1 Security update for ntfs-3g_ntfsprogs SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2965-1 Security update for ntfs-3g_ntfsprogs SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1001-1 Security update for ntfs-3g_ntfsprogs SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2020-1522 Low: libguestfs-winsupport security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 22, 2020
- ELSA-2019-3345 Low: virt:ol security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 14, 2019
- ELSA-2019-2308 Low: libguestfs-winsupport security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 13, 2019
References
- https://www.tuxera.com/community/release-history/
- RHSA-2019:2308 vendor-advisory
- RHSA-2019:3345 vendor-advisory
- RHBA-2019:3723 vendor-advisory
- GLSA-202007-45 vendor-advisory