CVE-2019-9755

An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges.

An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges.

An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• ntfs-3g: heap-based buffer overflow leads to local root privilege escalation (CVE-2019-9755)

• QEMU: slirp: information leakage in tcp_emu() due to uninitialized stack variables (CVE-2019-9824)

• QEMU: qxl: null pointer dereference while releasing spice resources (CVE-2019-12155)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section.

An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• ntfs-3g: heap-based buffer overflow leads to local root privilege escalation (CVE-2019-9755)

• QEMU: slirp: information leakage in tcp_emu() due to uninitialized stack variables (CVE-2019-9824)

• QEMU: qxl: null pointer dereference while releasing spice resources (CVE-2019-12155)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

This update for ntfs-3g_ntfsprogs fixes the following issues:

Security issues fixed:

• CVE-2019-9755: Fixed a heap-based buffer overflow which could lead to local privilege escalation (bsc#1130165).

This update was imported from the SUSE:SLE-15:Update update project.

This update for ntfs-3g_ntfsprogs fixes the following issues:

Update to version 2021.8.22 (bsc#1189720):

• Fixed compile error when building with libfuse < 2.8.0
• Fixed obsolete macros in configure.ac
• Signalled support of UTIME_OMIT to external libfuse2
• Fixed an improper macro usage in ntfscp.c
• Updated the repository change in the README
• Fixed vulnerability threats caused by maliciously tampered NTFS partitions
• Security fixes: CVE-2021-33285, CVE-2021-33286, CVE-2021-33287, CVE-2021-33289, CVE-2021-35266, CVE-2021-35267, CVE-2021-35268, CVE-2021-35269, CVE-2021-39251, CVE-2021-39252, CVE-2021-39253, CVE_2021-39254, CVE-2021-39255, CVE-2021-39256, CVE-2021-39257, CVE-2021-39258, CVE-2021-39259, CVE-2021-39260, CVE-2021-39261, CVE-2021-39262, CVE-2021-39263.

• Library soversion is now 89

• Changes in version 2017.3.23
• Delegated processing of special reparse points to external plugins
• Allowed kernel cacheing by lowntfs-3g when not using Posix ACLs
• Enabled fallback to read-only mount when the volume is hibernated
• Made a full check for whether an extended attribute is allowed
• Moved secaudit and usermap to ntfsprogs (now ntfssecaudit and ntfsusermap)
• Enabled encoding broken UTF-16 into broken UTF-8
• Autoconfigured selecting <sys/sysmacros.h> vs <sys/mkdev>
• Allowed using the full library API on systems without extended attributes support
• Fixed DISABLE_PLUGINS as the condition for not using plugins
• Corrected validation of multi sector transfer protected records
• Denied creating/removing files from $Extend
• Returned the size of locale encoded target as the size of symlinks

This update was imported from the SUSE:SLE-15:Update update project.

This update for ntfs-3g_ntfsprogs fixes the following issues:

Update to version 2021.8.22 (bsc#1189720):

• Fixed compile error when building with libfuse < 2.8.0
• Fixed obsolete macros in configure.ac
• Signalled support of UTIME_OMIT to external libfuse2
• Fixed an improper macro usage in ntfscp.c
• Updated the repository change in the README
• Fixed vulnerability threats caused by maliciously tampered NTFS partitions
• Security fixes: CVE-2021-33285, CVE-2021-33286, CVE-2021-33287, CVE-2021-33289, CVE-2021-35266, CVE-2021-35267, CVE-2021-35268, CVE-2021-35269, CVE-2021-39251, CVE-2021-39252, CVE-2021-39253, CVE_2021-39254, CVE-2021-39255, CVE-2021-39256, CVE-2021-39257, CVE-2021-39258, CVE-2021-39259, CVE-2021-39260, CVE-2021-39261, CVE-2021-39262, CVE-2021-39263.

• Library soversion is now 89

• Changes in version 2017.3.23
• Delegated processing of special reparse points to external plugins
• Allowed kernel cacheing by lowntfs-3g when not using Posix ACLs
• Enabled fallback to read-only mount when the volume is hibernated
• Made a full check for whether an extended attribute is allowed
• Moved secaudit and usermap to ntfsprogs (now ntfssecaudit and ntfsusermap)
• Enabled encoding broken UTF-16 into broken UTF-8
• Autoconfigured selecting <sys/sysmacros.h> vs <sys/mkdev>
• Allowed using the full library API on systems without extended attributes support
• Fixed DISABLE_PLUGINS as the condition for not using plugins
• Corrected validation of multi sector transfer protected records
• Denied creating/removing files from $Extend
• Returned the size of locale encoded target as the size of symlinks

This update for ntfs-3g_ntfsprogs fixes the following issues:

Security issues fixed:

• CVE-2019-9755: Fixed a heap-based buffer overflow which could lead to local privilege escalation (bsc#1130165).

This update for ntfs-3g_ntfsprogs fixes the following issues:

Security issues fixed:

• CVE-2019-9755: Fixed a heap-based buffer overflow which could lead to local privilege escalation (bsc#1130165).

This update for ntfs-3g_ntfsprogs fixes the following issues:

Update to version 2021.8.22 (bsc#1189720):

• Signalled support of UTIME_OMIT to external libfuse2
• Updated the repository change in the README
• Fixed vulnerability threats caused by maliciously tampered NTFS partitions
• Security fixes: CVE-2021-33285, CVE-2021-33286, CVE-2021-33287, CVE-2021-33289, CVE-2021-35266, CVE-2021-35267, CVE-2021-35268, CVE-2021-35269, CVE-2021-39251, CVE-2021-39252, CVE-2021-39253, CVE_2021-39254, CVE-2021-39255, CVE-2021-39256, CVE-2021-39257, CVE-2021-39258, CVE-2021-39259, CVE-2021-39260, CVE-2021-39261, CVE-2021-39262, CVE-2021-39263.

Changes in version 2017.3.23:

• Delegated processing of special reparse points to external plugins
• Allowed kernel cacheing by lowntfs-3g when not using Posix ACLs
• Enabled fallback to read-only mount when the volume is hibernated
• Made a full check for whether an extended attribute is allowed
• Moved secaudit and usermap to ntfsprogs (now ntfssecaudit and ntfsusermap)
• Enabled encoding broken UTF-16 into broken UTF-8
• Autoconfigured selecting <sys/sysmacros.h> vs <sys/mkdev>
• Allowed using the full library API on systems without extended attributes support
• Fixed DISABLE_PLUGINS as the condition for not using plugins
• Corrected validation of multi sector transfer protected records
• Denied creating/removing files from $Extend
• Returned the size of locale encoded target as the size of symlinks

Changes in version 2016.2.22:

• Changes to NTFS-3G driver:

  • Write as much data as possible in compressed attribute pwrite
  • Fixed getting space for making an index non resident
  • Alleviated constraints relative to reparse points
  • Fixed special case of decompressing a runlist
  • Fixed returning the trimming count to fstrim()
  • Fixed the range of valid subauthority counts in a SID
  • Updated the read-only flag even when the security attribute was cached
  • Defended against reusing data from an invalid MFT record
  • Simplified NTFS ACLs when group same as owner and same permission as world
  • Packed/unpacked st_rdev transported as 32-bits on Solaris 64-bits
  • Zero uninitialized bytes before writing compressed data
  • Clear the environment when starting mount or umount
  • Implemented rewinding a directory in lowntfs-3g
  • Use incremental offsets when reading a directory in lowntfs-3g

• Changes to mkntfs:

  • Make installing mkntfs /sbin symlinks dependent on ENABLE_MOUNT_HELPER
  • Mention the starting sector when it overflows in mkntfs
  • Upgraded the upper-case table to same as Windows 7, 8 and 10

• Changes to ntfsresize:

  • Fixed relocating the MFT runlists
  • Decode the full list of bad clusters
  • Fixed resizing an extended bad cluster list

• Changes to ntfsclone:

  • Decoded the full list of bad clusters

• Changes to ntfsinfo:

  • Displayed reparse point information

• Changes to ntfsdecrypt:

  • Fixed DESX decryption

• Changes to ntfswipe:

  • Added clarifications about several options to the manual

• New ntfsprogs tool:

  • Included ntfsrecover to recover the updates committed by Windows (experimental)

• Overall:

  • Made a general cleanup of endianness types for easier checks

Changes in version 2015.3.14:

• ntfs-3g: Fixed inserting a new ACL after wiping out by chkdsk
• ntfs-3g: Fixed Windows-type inheritance
• ntfs-3g: Fixed ignoring the umask mount option when permissions are used
• ntfs-3g: Fixed checking permissions when Posix ACLs are compiled in but not enabled
• ntfs-3g: Disabled option remove_hiberfile on read-only mounts
• ntfs-3g: Implemented an extended attribute to get/set EAs
• ntfs-3g: Avoid full runlist updating in more situations
• ntfs-3g: Update ctime after setting an ACL
• ntfs-3g: Use MFT record 15 for the first extent to MFT:DATA
• ntfs-3g: Ignore the sloppy mount option (-s)
• ntfs-3g: Implemented FITRIM (fstrim) ioctl
• ntfs-3g: Reengineered the compression algorithm
• ntfsprogs: Added manuals for ntfsdecrypt,…

This update for ntfs-3g_ntfsprogs fixes the following issues:

Update to version 2021.8.22 (bsc#1189720):

• Fixed compile error when building with libfuse < 2.8.0
• Fixed obsolete macros in configure.ac
• Signalled support of UTIME_OMIT to external libfuse2
• Fixed an improper macro usage in ntfscp.c
• Updated the repository change in the README
• Fixed vulnerability threats caused by maliciously tampered NTFS partitions
• Security fixes: CVE-2021-33285, CVE-2021-33286, CVE-2021-33287, CVE-2021-33289, CVE-2021-35266, CVE-2021-35267, CVE-2021-35268, CVE-2021-35269, CVE-2021-39251, CVE-2021-39252, CVE-2021-39253, CVE_2021-39254, CVE-2021-39255, CVE-2021-39256, CVE-2021-39257, CVE-2021-39258, CVE-2021-39259, CVE-2021-39260, CVE-2021-39261, CVE-2021-39262, CVE-2021-39263.

• Library soversion is now 89

• Changes in version 2017.3.23
• Delegated processing of special reparse points to external plugins
• Allowed kernel cacheing by lowntfs-3g when not using Posix ACLs
• Enabled fallback to read-only mount when the volume is hibernated
• Made a full check for whether an extended attribute is allowed
• Moved secaudit and usermap to ntfsprogs (now ntfssecaudit and ntfsusermap)
• Enabled encoding broken UTF-16 into broken UTF-8
• Autoconfigured selecting <sys/sysmacros.h> vs <sys/mkdev>
• Allowed using the full library API on systems without extended attributes support
• Fixed DISABLE_PLUGINS as the condition for not using plugins
• Corrected validation of multi sector transfer protected records
• Denied creating/removing files from $Extend
• Returned the size of locale encoded target as the size of symlinks

A heap buffer overflow was discovered in NTFS-3G when executing it with a relative mount point path that is too long. A local attacker could potentially exploit this to execute arbitrary code as the administrator.