GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
oesa-2021-1365
Vulnerability from osv_openeuler
Published
2021-09-30 11:04
Modified
2026-08-06 11:04
Summary
ntfs-3g security update
Details

NTFS-3G is a stable, open source, GPL licensed, POSIX, read/write NTFS driver for Linux and many other operating systems. It provides safe handling of the Windows XP, Windows Server 2003, Windows 2000, Windows Vista, Windows Server 2008 and Windows 7 NTFS file systems.

Security Fix(es):

In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur allowing for memory disclosure or denial of service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the "bytes_in_use" field should be less than the "bytes_allocated" field. When it is not, the parsing of the records proceeds into the wild.(CVE-2021-33285)

A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G < 2021.8.22.(CVE-2021-39252)

A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in NTFS-3G < 2021.8.22.(CVE-2021-39255)

In NTFS-3G versions < 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution.(CVE-2021-33289)

In NTFS-3G versions < 2021.8.22, when a specially crafted unicode string is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution.(CVE-2021-33286)

NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buffer overflow can occur allowing for code execution and escalation of privileges.(CVE-2021-35269)

A crafted NTFS image can cause a heap-based buffer overflow in ntfs_compressed_pwrite in NTFS-3G < 2021.8.22.(CVE-2021-39261)

A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfs_get_attribute_value, in NTFS-3G < 2021.8.22.(CVE-2021-39263)

A crafted NTFS image can cause an out-of-bounds access in ntfs_decompress in NTFS-3G < 2021.8.22.(CVE-2021-39262)

A crafted NTFS image can cause an out-of-bounds access in ntfs_inode_sync_standard_information in NTFS-3G < 2021.8.22.(CVE-2021-39260)

A crafted NTFS image can trigger an out-of-bounds access, caused by an unsanitized attribute length in ntfs_inode_lookup_by_name, in NTFS-3G < 2021.8.22.(CVE-2021-39259)

In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow can occur allowing for code execution and escalation of privileges.(CVE-2021-35268)

A crafted NTFS image can cause a heap-based buffer overflow in ntfs_inode_lookup_by_name in NTFS-3G < 2021.8.22.(CVE-2021-39256)

A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22.(CVE-2021-39253)

In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur resulting in memory disclosure, denial of service and even code execution.(CVE-2021-35266)

A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22.(CVE-2021-39258)

In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of service of the application.(CVE-2021-33287)

A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs_attr_record_resize, in NTFS-3G < 2021.8.22.(CVE-2021-39254)

NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror allowing for code execution or escalation of privileges when setuid-root.(CVE-2021-35267)

A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs_attr_pwrite), causing stack consumption in NTFS-3G < 2021.8.22.(CVE-2021-39257)

A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G < 2021.8.22.(CVE-2021-39251)

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "ntfs-3g-debugsource-2021.8.22-1.oe1.aarch64.rpm",
          "ntfs-3g-debuginfo-2021.8.22-1.oe1.aarch64.rpm",
          "ntfs-3g-devel-2021.8.22-1.oe1.aarch64.rpm",
          "ntfs-3g-2021.8.22-1.oe1.aarch64.rpm",
          "ntfs-3g-help-2021.8.22-1.oe1.aarch64.rpm"
        ],
        "src": [
          "ntfs-3g-2021.8.22-1.oe1.src.rpm"
        ],
        "x86_64": [
          "ntfs-3g-debugsource-2021.8.22-1.oe1.x86_64.rpm",
          "ntfs-3g-help-2021.8.22-1.oe1.x86_64.rpm",
          "ntfs-3g-2021.8.22-1.oe1.x86_64.rpm",
          "ntfs-3g-debuginfo-2021.8.22-1.oe1.x86_64.rpm",
          "ntfs-3g-devel-2021.8.22-1.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP1",
        "name": "ntfs-3g",
        "purl": "pkg:rpm/openEuler/ntfs-3g\u0026distro=openEuler-20.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2021.8.22-1.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "ntfs-3g-help-2021.8.22-1.oe1.aarch64.rpm",
          "ntfs-3g-debugsource-2021.8.22-1.oe1.aarch64.rpm",
          "ntfs-3g-devel-2021.8.22-1.oe1.aarch64.rpm",
          "ntfs-3g-2021.8.22-1.oe1.aarch64.rpm",
          "ntfs-3g-debuginfo-2021.8.22-1.oe1.aarch64.rpm"
        ],
        "src": [
          "ntfs-3g-2021.8.22-1.oe1.src.rpm"
        ],
        "x86_64": [
          "ntfs-3g-devel-2021.8.22-1.oe1.x86_64.rpm",
          "ntfs-3g-2021.8.22-1.oe1.x86_64.rpm",
          "ntfs-3g-debuginfo-2021.8.22-1.oe1.x86_64.rpm",
          "ntfs-3g-debugsource-2021.8.22-1.oe1.x86_64.rpm",
          "ntfs-3g-help-2021.8.22-1.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP2",
        "name": "ntfs-3g",
        "purl": "pkg:rpm/openEuler/ntfs-3g\u0026distro=openEuler-20.03-LTS-SP2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2021.8.22-1.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "NTFS-3G is a stable, open source, GPL licensed, POSIX, read/write NTFS driver for Linux and many other operating systems. It provides safe handling of the Windows XP, Windows Server 2003, Windows 2000, Windows Vista, Windows Server 2008 and Windows 7 NTFS file systems.\r\n\r\nSecurity Fix(es):\r\n\r\nIn NTFS-3G versions \u0026lt; 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur allowing for memory disclosure or denial of service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the \u0026quot;bytes_in_use\u0026quot; field should be less than the \u0026quot;bytes_allocated\u0026quot; field. When it is not, the parsing of the records proceeds into the wild.(CVE-2021-33285)\r\n\r\nA crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G \u0026lt; 2021.8.22.(CVE-2021-39252)\r\n\r\nA crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in NTFS-3G \u0026lt; 2021.8.22.(CVE-2021-39255)\r\n\r\nIn NTFS-3G versions \u0026lt; 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution.(CVE-2021-33289)\r\n\r\nIn NTFS-3G versions \u0026lt; 2021.8.22, when a specially crafted unicode string is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution.(CVE-2021-33286)\r\n\r\nNTFS-3G versions \u0026lt; 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buffer overflow can occur allowing for code execution and escalation of privileges.(CVE-2021-35269)\r\n\r\nA crafted NTFS image can cause a heap-based buffer overflow in ntfs_compressed_pwrite in NTFS-3G \u0026lt; 2021.8.22.(CVE-2021-39261)\r\n\r\nA crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfs_get_attribute_value, in NTFS-3G \u0026lt; 2021.8.22.(CVE-2021-39263)\r\n\r\nA crafted NTFS image can cause an out-of-bounds access in ntfs_decompress in NTFS-3G \u0026lt; 2021.8.22.(CVE-2021-39262)\r\n\r\nA crafted NTFS image can cause an out-of-bounds access in ntfs_inode_sync_standard_information in NTFS-3G \u0026lt; 2021.8.22.(CVE-2021-39260)\r\n\r\nA crafted NTFS image can trigger an out-of-bounds access, caused by an unsanitized attribute length in ntfs_inode_lookup_by_name, in NTFS-3G \u0026lt; 2021.8.22.(CVE-2021-39259)\r\n\r\nIn NTFS-3G versions \u0026lt; 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow can occur allowing for code execution and escalation of privileges.(CVE-2021-35268)\r\n\r\nA crafted NTFS image can cause a heap-based buffer overflow in ntfs_inode_lookup_by_name in NTFS-3G \u0026lt; 2021.8.22.(CVE-2021-39256)\r\n\r\nA crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G \u0026lt; 2021.8.22.(CVE-2021-39253)\r\n\r\nIn NTFS-3G versions \u0026lt; 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur resulting in memory disclosure, denial of service and even code execution.(CVE-2021-35266)\r\n\r\nA crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G \u0026lt; 2021.8.22.(CVE-2021-39258)\r\n\r\nIn NTFS-3G versions \u0026lt; 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of service of the application.(CVE-2021-33287)\r\n\r\nA crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs_attr_record_resize, in NTFS-3G \u0026lt; 2021.8.22.(CVE-2021-39254)\r\n\r\nNTFS-3G versions \u0026lt; 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror allowing for code execution or escalation of privileges when setuid-root.(CVE-2021-35267)\r\n\r\nA crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs_attr_pwrite), causing stack consumption in NTFS-3G \u0026lt; 2021.8.22.(CVE-2021-39257)\r\n\r\nA crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G \u0026lt; 2021.8.22.(CVE-2021-39251)",
  "id": "OESA-2021-1365",
  "modified": "2026-08-06T11:04:38Z",
  "published": "2021-09-30T11:04:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1365"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33285"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39252"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39255"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33289"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33286"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35269"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39261"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39263"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39262"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39260"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39259"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35268"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39256"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39253"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35266"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39258"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33287"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39254"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35267"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39257"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39251"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ntfs-3g security update",
  "upstream": [
    "CVE-2021-33285",
    "CVE-2021-39252",
    "CVE-2021-39255",
    "CVE-2021-33289",
    "CVE-2021-33286",
    "CVE-2021-35269",
    "CVE-2021-39261",
    "CVE-2021-39263",
    "CVE-2021-39262",
    "CVE-2021-39260",
    "CVE-2021-39259",
    "CVE-2021-35268",
    "CVE-2021-39256",
    "CVE-2021-39253",
    "CVE-2021-35266",
    "CVE-2021-39258",
    "CVE-2021-33287",
    "CVE-2021-39254",
    "CVE-2021-35267",
    "CVE-2021-39257",
    "CVE-2021-39251"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.