Published: 13/04/2018 Updated: 03/10/2019

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 730

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.

Vulnerable Product	Search on Vulmon	Subscribe to Product
tuxera ntfs-3g
debian debian linux 8.0

NTFS-3G could be made to load kernel modules as an administrator ...

ntfs-3g mount helper in Ubuntu 1604, 1610, Debian 7, 8, and possibly 9 does not properly sanitize the environment when executing modprobe This can be abused to load a kernel module and execute a binary payload as the root user ...

#!/bin/bash echo "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@" echo "@ CVE-2017-0359, PoC by Kristian Erik Hermansen @" echo "@ ntfs-3g local privilege escalation to root @" echo "@ Credits to Google Project Zero @" echo "@ Affects: Debian 9/8/7, Ubuntu, Gentoo, others @" echo "@ Tested: Debian 9 (Stretch) ...

Source: bugschromiumorg/p/project-zero/issues/detail?id=1072 ntfs-3g is installed by default eg on Ubuntu and comes with a setuid root program /bin/ntfs-3g When this program is invoked on a system whose kernel does not support FUSE filesystems (detected by get_fuse_fstype()), ntfs-3g attempts to load the "fuse" module using /sbin/modp ...

CWE-269 http://www.openwall.com/lists/oss-security/2017/02/04/1 https://www.exploit-db.com/exploits/41356/https://www.exploit-db.com/exploits/41240/https://security.gentoo.org/glsa/201702-10 https://marc.info/?l=oss-security&m=148594671929354&w=2 http://www.securityfocus.com/bid/95987 https://www.debian.org/security/2017/dsa-3780 https://usn.ubuntu.com/3182-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/41240/

CVE-2017-0358

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect