{"id":"CVE-2017-0358","aliases":["DEBIAN-CVE-2017-0358","DLA-815-1","DSA-3780-1","EUVD-2017-0714","GHSA-vghw-r4fc-pgpf","SUSE-SU-2018:2070-1","SUSE-SU-2018:3587-1","SUSE-SU-2018:3587-2","SUSE-SU-2021:2965-1","UBUNTU-CVE-2017-0358","USN-3182-1"],"status":"published","title":"ntfs-3g: Modprobe influence vulnerability via environment variables","description":"Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02189,"percentile":0.82534,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-269"],"published":"2017-02-01T00:00:00Z","modified":"2026-10-24T10:30:31Z","exploits":[{"source":"metasploit","id":"exploit/linux/local/ntfs3g_priv_esc","title":"Debian/Ubuntu ntfs-3g Local Privilege Escalation","type":"exploit","platform":"Linux","date":"2017-01-05","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/local/ntfs3g_priv_esc"},{"source":"exploitdb","id":"EDB-41240","title":"ntfs-3g (Debian 9) - Local Privilege Escalation","type":"local","platform":"linux","date":"2017-02-03","url":"https://www.exploit-db.com/exploits/41240"},{"source":"exploitdb","id":"EDB-41356","title":"ntfs-3g - Unsanitized modprobe Environment Privilege Escalation","type":"local","platform":"linux","date":"2017-02-14","verified":true,"url":"https://www.exploit-db.com/exploits/41356"},{"source":"pocgithub","id":"Wangsafz/cve-2017-0358.sh","title":"Wangsafz/cve-2017-0358.sh","date":"2022-04-12","url":"https://github.com/Wangsafz/cve-2017-0358.sh"}],"fixes":[{"ecosystem":"Debian:12","package":"ntfs-3g","fixed_in":["1:2016.2.22AR.1-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ntfs-3g","fixed_in":["1:2016.2.22AR.1-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ntfs-3g","fixed_in":["1:2016.2.22AR.1-4"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"ntfs-3g","fixed_in":["1:2012.1.15AR.5-2.1+deb7u3"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"ntfs-3g","fixed_in":["1:2014.2.15AR.2-1+deb8u3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"ntfs-3g","fixed_in":["2011.4.12-0.9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"ntfs-3g_ntfsprogs","fixed_in":["2013.1.13-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"ntfs-3g_ntfsprogs","fixed_in":["2013.1.13-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"ntfs-3g_ntfsprogs","fixed_in":["2013.1.13-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"ntfs-3g_ntfsprogs","fixed_in":["2013.1.13-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"ntfs-3g_ntfsprogs","fixed_in":["2013.1.13-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"ntfs-3g_ntfsprogs","fixed_in":["2013.1.13-5.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"ntfs-3g","fixed_in":["1:2015.3.14AR.1-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2016.2.22AR.1-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2016.2.22AR.1-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2016.2.22AR.1-4"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2012.1.15AR.5-2.1+deb7u3"}]}],"versions":["1:2012.1.15AR.5-2.1","1:2012.1.15AR.5-2.1+deb7u1","1:2012.1.15AR.5-2.1+deb7u2"]},{"source":"osv","ecosystem":"Debian:8","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2014.2.15AR.2-1+deb8u3"}]}],"versions":["1:2014.2.15AR.2-1","1:2014.2.15AR.2-1+deb8u1","1:2014.2.15AR.2-1+deb8u2"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2011.4.12-0.9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"ntfs-3g_ntfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2013.1.13-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"ntfs-3g_ntfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2013.1.13-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"ntfs-3g_ntfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2013.1.13-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"ntfs-3g_ntfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2013.1.13-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"ntfs-3g_ntfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2013.1.13-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"ntfs-3g_ntfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2013.1.13-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"ntfs-3g_ntfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.8.22-5.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"ntfs-3g_ntfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.8.22-5.9.1"}]}],"bundled":22},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2015.3.14AR.1-1ubuntu0.1"}]}],"versions":["1:2014.2.15AR.3-3","1:2015.3.14AR.1-1","1:2015.3.14AR.1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ntfs-3g","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2015.3.14AR.1-1ubuntu0.1"}]}],"versions":["1:2014.2.15AR.3-3","1:2015.3.14AR.1-1","1:2015.3.14AR.1-1build1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"ntfs-3g","product":"ntfs-3g"},{"vendor":"tuxera","product":"ntfs-3g"}],"references":[{"url":"https://security.gentoo.org/glsa/201702-10","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2017/dsa-3780","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://www.exploit-db.com/exploits/41240/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://www.exploit-db.com/exploits/41356/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://www.securityfocus.com/bid/95987","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://marc.info/?l=oss-security\u0026m=148594671929354\u0026w=2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"http://www.openwall.com/lists/oss-security/2017/02/04/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0358"},{"url":"https://www.exploit-db.com/exploits/41240"},{"url":"https://www.exploit-db.com/exploits/41356"},{"url":"https://github.com/advisories/GHSA-vghw-r4fc-pgpf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-0358","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182070-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1022500","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0358","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183587-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183587-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212965-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1189720","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39263","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-0358","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3182-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-0358","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-0358","title":"ntfs-3g: Modprobe influence vulnerability via environment variables","description":"Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.","status":"published","published":"2018-04-13T15:00:00Z","modified":"2025-12-04T16:01:26.539Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:33:22.064284Z"}],"euvd":[{"id":"EUVD-2017-0714","description":"Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.","status":"published","published":"2018-04-13T15:00:00Z","modified":"2025-12-04T16:01:26Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:09.83206Z"}],"ghsa":[{"id":"GHSA-vghw-r4fc-pgpf","title":"Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does...","description":"Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.","status":"published","published":"2022-05-13T01:39:57Z","modified":"2025-12-04T18:31:40Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:05:03.172685Z"}],"nvd":[{"id":"CVE-2017-0358","description":"Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.","status":"published","published":"2018-04-13T15:29:00.397Z","modified":"2026-06-17T00:57:33.783Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:04:17.032862Z"}],"osv":[{"id":"CVE-2017-0358","description":"Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.","status":"published","published":"2018-04-13T15:29:00.397Z","modified":"2026-10-24T10:30:31.428703099Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.472693Z"},{"id":"DEBIAN-CVE-2017-0358","description":"Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.","status":"published","published":"2018-04-13T15:29:00.397Z","modified":"2026-09-01T20:03:40.118615089Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"UBUNTU-CVE-2017-0358","description":"Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.","status":"published","published":"2017-02-01T14:00:00Z","modified":"2026-04-22T11:07:25.289354Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:13.356796Z"},{"id":"DLA-815-1","title":"ntfs-3g - security update","status":"published","published":"2017-02-02T00:00:00Z","modified":"2026-03-09T02:09:54.019536Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3780-1","title":"ntfs-3g - security update","status":"published","published":"2017-02-01T00:00:00Z","modified":"2026-03-09T01:18:48.050896Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"SUSE-SU-2018:2070-1","title":"Security update for ntfs-3g","description":"This update for ntfs-3g fixes the following issues:\n\n- CVE-2017-0358: Missing sanitization of the environment during a call to\n  modprobe allowed local users to escalate fo root privilege (bsc#1022500)\n","status":"published","published":"2018-07-26T14:37:15Z","modified":"2026-02-04T03:59:47.022268Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:3587-1","title":"Security update for ntfs-3g_ntfsprogs","description":"This update for ntfs-3g_ntfsprogs fixes the following issues:\n\n- CVE-2017-0358: Missing sanitization of the environment during a call to\n  modprobe allowed local users to escalate fo root privilege (bsc#1022500)\n","status":"published","published":"2018-10-31T09:49:46Z","modified":"2026-02-04T03:20:27.990863Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3587-2","title":"Security update for ntfs-3g_ntfsprogs","description":"This update for ntfs-3g_ntfsprogs fixes the following issues:\n\n- CVE-2017-0358: Missing sanitization of the environment during a call to\n  modprobe allowed local users to escalate fo root privilege (bsc#1022500)\n","status":"published","published":"2018-12-13T13:38:21Z","modified":"2026-02-04T03:35:41.710699Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2021:2965-1","title":"Security update for ntfs-3g_ntfsprogs","description":"This update for ntfs-3g_ntfsprogs fixes the following issues:\n\nUpdate to version 2021.8.22 (bsc#1189720):\n\n* Signalled support of UTIME_OMIT to external libfuse2\n* Updated the repository change in the README\n* Fixed vulnerability threats caused by maliciously tampered\n  NTFS partitions\n* Security fixes: CVE-2021-33285, CVE-2021-33286, CVE-2021-33287,\n  CVE-2021-33289, CVE-2021-35266, CVE-2021-35267, CVE-2021-35268,\n  CVE-2021-35269, CVE-2021-39251, CVE-2021-39252, CVE-2021-39253,\n  CVE_2021-39254, CVE-2021-39255, CVE-2021-39256, CVE-2021-39257,\n  CVE-2021-39258, CVE-2021-39259, CVE-2021-39260, CVE-2021-39261,\n  CVE-2021-39262, CVE-2021-39263.\n\nChanges in version 2017.3.23:\n\n* Delegated processing of special reparse points to external plugins\n* Allowed kernel cacheing by lowntfs-3g when not using Posix ACLs\n* Enabled fallback to read-only mount when the volume is hibernated\n* Made a full check for whether an extended attribute is allowed\n* Moved secaudit and usermap to ntfsprogs (now ntfssecaudit and ntfsusermap)\n* Enabled encoding broken UTF-16 into broken UTF-8\n* Autoconfigured selecting \u003csys/sysmacros.h\u003e vs \u003csys/mkdev\u003e\n* Allowed using the full library API on systems without extended attributes support\n* Fixed DISABLE_PLUGINS as the condition for not using plugins\n* Corrected validation of multi sector transfer protected records\n* Denied creating/removing files from $Extend\n* Returned the size of locale encoded target as the size of symlinks\n\nChanges in version 2016.2.22:\n\n- Changes to NTFS-3G driver:\n\n  - Write as much data as possible in compressed attribute pwrite\n  - Fixed getting space for making an index non resident\n  - Alleviated constraints relative to reparse points\n  - Fixed special case of decompressing a runlist\n  - Fixed returning the trimming count to fstrim()\n  - Fixed the range of valid subauthority counts in a SID\n  - Updated the read-only flag even when the security attribute was cached\n  - Defended against reusing data from an invalid MFT record\n  - Simplified NTFS ACLs when group same as owner and same permission as world\n  - Packed/unpacked st_rdev transported as 32-bits on Solaris 64-bits\n  - Zero uninitialized bytes before writing compressed data\n  - Clear the environment when starting mount or umount\n  - Implemented rewinding a directory in lowntfs-3g\n  - Use incremental offsets when reading a directory in lowntfs-3g\n \n- Changes to mkntfs:\n\n  - Make installing mkntfs /sbin symlinks dependent on ENABLE_MOUNT_HELPER\n  - Mention the starting sector when it overflows in mkntfs\n  - Upgraded the upper-case table to same as Windows 7, 8 and 10\n\n- Changes to ntfsresize:\n\n  - Fixed relocating the MFT runlists\n  - Decode the full list of bad clusters\n  - Fixed resizing an extended bad cluster list\n\n- Changes to ntfsclone:\n\n  - Decoded the full list of bad clusters\n\n- Changes to ntfsinfo:\n\n  - Displayed reparse point information\n\n- Changes to ntfsdecrypt:\n\n  - Fixed DESX decryption\n\n- Changes to ntfswipe:\n\n  - Added clarifications about several options to the manual\n\n- New ntfsprogs tool:\n\n  - Included ntfsrecover to recover the updates committed by Windows (experimental)\n\n- Overall:\n  - Made a general cleanup of endianness types for easier checks\n\nChanges in version 2015.3.14:\n\n- ntfs-3g: Fixed inserting a new ACL after wiping out by chkdsk\n- ntfs-3g: Fixed Windows-type inheritance\n- ntfs-3g: Fixed ignoring the umask mount option when permissions are used\n- ntfs-3g: Fixed checking permissions when Posix ACLs are compiled in but not enabled\n- ntfs-3g: Disabled option remove_hiberfile on read-only mounts\n- ntfs-3g: Implemented an extended attribute to get/set EAs\n- ntfs-3g: Avoid full runlist updating in more situations\n- ntfs-3g: Update ctime after setting an ACL\n- ntfs-3g: Use MFT record 15 for the first extent to MFT:DATA\n- ntfs-3g: Ignore the sloppy mount option (-s)\n- ntfs-3g: Implemented FITRIM (fstrim) ioctl\n- ntfs-3g: Reengineered the compression algorithm\n- ntfsprogs: Added manuals for ntfsdecrypt, ntfswipe, ntfstruncate and ntfsfallocate\n","status":"published","published":"2021-09-07T07:48:15Z","modified":"2026-02-04T02:34:54.769567Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"USN-3182-1","title":"ntfs-3g vulnerability","description":"Jann Horn discovered that NTFS-3G incorrectly filtered environment variables\nwhen using the modprobe utility. A local attacker could possibly use this issue\nto load arbitrary kernel modules.\n","status":"published","published":"2017-02-01T16:07:31Z","modified":"2026-04-22T09:31:47.361416Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}