OESA-2022-1685

    Dashboard / Vulnerabilities / OESA-2022-1685

    OESA-2022-1685

    Published: 2 Jun 2022Last Modified: 18 Aug 2026

    Summary: ntfs-3g security update

    Details: NTFS-3G is a stable, open source, GPL licensed, POSIX, read/write NTFS driver for Linux and many other operating systems. It provides safe handling of the Windows XP, Windows Server 2003, Windows 2000, Windows Vista, Windows Server 2008 and Windows 7 NTFS file systems. Security Fix(es): ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2. NOTE: the upstream position is that ntfsck is deprecated; however, it is shipped by some Linux distributions.(CVE-2021-46790) An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G through 2021.8.22 when using libfuse-lite.(CVE-2022-30783) A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite.(CVE-2022-30785) An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through 2021.8.22 when using libfuse-lite.(CVE-2022-30787) A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.(CVE-2022-30784) A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22.(CVE-2022-30786) A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22.(CVE-2022-30788) A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through 2021.8.22.(CVE-2022-30789)

    References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1685, https://nvd.nist.gov/vuln/detail/CVE-2021-46790, https://nvd.nist.gov/vuln/detail/CVE-2022-30783, https://nvd.nist.gov/vuln/detail/CVE-2022-30785, https://nvd.nist.gov/vuln/detail/CVE-2022-30787, https://nvd.nist.gov/vuln/detail/CVE-2022-30784, https://nvd.nist.gov/vuln/detail/CVE-2022-30786, https://nvd.nist.gov/vuln/detail/CVE-2022-30788, https://nvd.nist.gov/vuln/detail/CVE-2022-30789

    Affected packages

    Package

    Name: ntfs-3g

    Purl: pkg:rpm/openEuler/ntfs-3g&distro=openEuler-20.03-LTS-SP1

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2022.5.17-1.oe1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    OESA-2022-1685 | CVE-DB