INFRA Signal 390
Reportedly, NTFS3 driver flaw lets crafted NTFS image give root on Linux
↗
Illustration only Photo by Aaron McLean on Unsplash
Reported NTFS3 driver flaw permits root via crafted NTFS image.
If exploited, an attacker with physical access can gain full control of a Linux system. The vulnerability has not been fixed since it was first reported this summer. This poses a risk for any Linux system that processes NTFS storage.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
A reported vulnerability exists in the NTFS3 driver.
The flaw allows root access when a specially crafted NTFS image is mounted.
It has remained unaddressed since being reported earlier this summer.
THE READ
What the cluster adds up to.
The NTFS3 driver processes NTFS filesystem images as part of its normal operation. A specially crafted NTFS image can contain malformed structures that trigger a bug in the driver. When this bug is triggered, the driver executes code with the privileges of the process mounting the image. In many configurations, that process runs as root, leading to privilege escalation.
To exploit the flaw, an attacker must present a crafted NTFS image to the system, for example on a USB flash drive. This requires physical access to attach the USB device. Once mounted, the exploit runs with root privileges, giving the attacker full control of the host. The consequence is potential compromise of the system.
If the NTFS3 driver is disabled or not present, the crafted image cannot trigger the vulnerability. Similarly, if the system does not attempt to mount the NTFS image, the exploit does not execute. Therefore, the risk is limited to environments where NTFS3 is active and untrusted NTFS media may be connected. In such settings, the vulnerability remains effective until the driver is patched or the image is rejected.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER