CVE-2021-35268 describes a heap buffer overflow vulnerability in NTFS-3G versions prior to 2021.8.22, affecting various Linux distributions and the NTFS-3G driver itself. This flaw, triggered by a specially crafted NTFS inode, allows for local privilege escalation and arbitrary code execution. Rated with a CVSS score of 7.8 (High), it requires local access and low privileges but has a high impact on confidentiality, integrity, and availability. Currently, there is no known active exploitation, publicly available exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2021.8.22CPE matchmatch criteria | cpe:2.3:a:tuxera:ntfs-3g:*:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | ||
11.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | ||
33CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2021-35268
Dec 14, 2021In NTFS-3G versions < 2021.8.22 when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open a heap buffer overflow can occur allowing for code execution and escalation of privileges.
Sep 14, 2021ntfs-3g: Heap buffer overflow in ntfs_inode_real_open() triggered by a specially crafted NTFS inode
Aug 30, 2021