CVE-2021-33285 — Vulnetix

Try Vulnetix Request Demo

CVE-2021-33285 PUBLISHED

In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur allowing for memory disclosure or denial of service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the "bytes_in_use" field should be less than the "bytes_allocated" field. When it is not, the parsing of the records proceeds into the wild.

EPSS 0.03% · 9.8th percentile

Risk Scores

EPSS Score

0.03%

9.8th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:Pro:14.04:LTS	ntfs-3g	1:2013.1.13AR.1-2ubuntu1, 1:2013.1.13AR.1-2ubuntu2, 0
Ubuntu:20.04:LTS	ntfs-3g	0, 1:2017.3.23AR.3-3ubuntu1
Ubuntu:22.04:LTS	ntfs-3g	0
Ubuntu:18.04:LTS	ntfs-3g	1:2017.3.23-2ubuntu0.18.04.1, 1:2017.3.23-2ubuntu0.18.04.2, 0
Ubuntu:Pro:16.04:LTS	ntfs-3g	1:2014.2.15AR.3-3, 1:2015.3.14AR.1-1build1, 0

Timeline

Sep 7, 2021 CVE Published
Sep 8, 2021 EPSS Score
Nov 4, 2021 EPSS Score
Dec 31, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 26, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Apr 25, 2022 EPSS Score
Jun 21, 2022 EPSS Score
Aug 18, 2022 EPSS Score
Oct 14, 2022 EPSS Score
Dec 10, 2022 EPSS Score

References

https://ubuntu.com/security/CVE-2021-33285 third-party-advisory
https://www.openwall.com/lists/oss-security/2021/08/30/1 third-party-advisory
https://ubuntu.com/security/notices/USN-5060-1 vendor-advisory
https://ubuntu.com/security/notices/USN-5060-2 vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2021-33285 third-party-advisory

Open in Interactive Console →