SECURITY Signal 402
Crafted NTFS USB image grants root via unchecked SUID bits in ntfs3
↗
Illustration only Photo by Conny Schneider on Unsplash
Attackers can gain root privileges by mounting a specially crafted NTFS USB drive that sets SUID bits on a binary.
The vulnerability affects any Linux system with the ntfs3 driver enabled that automounts NTFS volumes with the suid option. An attacker only needs physical access to plug in a malicious USB drive; the exploit works deterministically on the first attempt. This allows unprivileged users to obtain immediate root access without race conditions or heap spraying.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The flaw lies in ntfs_get_wsl_perm() where the $LXMOD extended attribute is copied to inode->i_mode without clearing SUID or S_ISGID bits.
A crafted NTFS image with $LXUID=0, $LXGID=0, and $LXMOD=0104755 creates a setuid-root binary when the volume is mounted.
Applying a one-line mask to drop SUID and SGID bits (inode->i_mode = le32_to_cpu(value[2]) & ~(S_ISUID | S_ISGID)) mitigates the issue.
THE READ
What the cluster adds up to.
The vulnerability stems from the ntfs3 filesystem driver trusting on-disk extended attribute data. In fs/ntfs3/xattr.c the function ntfs_get_wsl_perm() assigns the raw $LXMOD value directly to the inode’s mode bits, preserving any SUID or SGID flags present in the crafted image. When a USB drive containing such an image is automounted, the binary appears as a setuid-root executable to any local user.
Adopting the proposed fix requires a minimal one-line patch to the ntfs_get_wsl_perm() function, adding a bitmask that clears SUID and SGID before assigning the mode. This change introduces no measurable performance overhead and does not affect legitimate NTFS functionality, as ordinary files rarely rely on those bits being set from on-disk EA data.
The fix stops working only for systems that intentionally depend on SUID or SGID bits being propagated from NTFS extended attributes, a use case not documented or expected in the driver. Systems that mount NTFS with the nosuid option, or those with CONFIG_NTFS3_FS disabled, were already unaffected and remain so after the patch.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER