ALT-PU-2017-1420-1
Closed vulnerabilities
Published: 2018-04-13
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2017-0358
Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.
Severity: HIGH (7.8)
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References:
- [oss-security] 20170203 Re: CVE-2017-0358 ntfs-3g: modprobe influence vulnerability via environment variables
- [oss-security] 20170203 Re: CVE-2017-0358 ntfs-3g: modprobe influence vulnerability via environment variables
- 95987
- 95987
- [oss-security] 20170201 CVE-2017-0358 ntfs-3g: modprobe influence vulnerability via environment variables
- [oss-security] 20170201 CVE-2017-0358 ntfs-3g: modprobe influence vulnerability via environment variables
- GLSA-201702-10
- GLSA-201702-10
- DSA-3780
- DSA-3780
- 41240
- 41240
- 41356
- 41356