CVE-2021-46790

Name of the Vulnerable Software and Affected Versions NTFS-3G versions through 2021.8.22

Description The issue is related to a heap-based buffer overflow in the NTFS-3G module, specifically involving the check file record function and the ntfsck tool. This overflow occurs in dynamic memory and can be exploited by a remote attacker to execute arbitrary code with elevated privileges using a specially crafted malicious NTFS file system. The ntfsck tool is noted to be deprecated upstream but is still shipped by some Linux distributions.

Recommendations For NTFS-3G versions through 2021.8.22, consider disabling the ntfsck tool or restricting its use until a patch is available to mitigate the risk of exploitation. As a temporary workaround, avoid using the check file record function in the NTFS-3G module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.