A reported security vulnerability for the NTFS3 driver has gone unaddressed since being reported earlier this summer. The vulnerability allows a pre-crafted NTFS image on a USB flash drive or similar to allow the user to gain root access to the running Linux system.

After being reported privately two months ago and going unresolved, a SUID injection leading to local privilege escalation was made public. A Phoronix reader noted the disclosure via the NTFS3 mailing list.

Vova Tokarev who discovered the issue noted:

"A pre-crafted NTFS image (e.g. USB drive) with $LXUID=0, $LXGID=0, $LXMOD=0104755 already in the MFT produces a setuid-root binary the moment the volume is mounted. No setxattr() is involved -- the EAs are on disk. The -EPERM check doesn't help.

The root cause is still at fs/ntfs3/xattr.c:1022:

inode->i_mode = le32_to_cpu(value[2]);

This loads S_ISUID/S_ISGID directly from untrusted on-disk data. Desktop automounters (udisks) mount NTFS with suid by default, so plugging in a crafted USB gives any local user euid=0.

Suggested one-line fix:

- inode->i_mode = le32_to_cpu(value[2]);

+ inode->i_mode = le32_to_cpu(value[2]) & ~(S_ISUID | S_ISGID);

I have a full PoC and working demo."

Those interested can find the proof of concept and demo along with more information via [1]this mailing list post .

[2]

As of writing the vulnerability has yet to be addressed by the mainline NTFS3 kernel driver. This doesn't appear to impact [3]the newer NTFS driver alternative that also continues maturing within the mainline kernel tree.



[1] https://lore.kernel.org/ntfs3/CAGBKPgPiXyKWtjgYSACnugmG1XPs=mPg-Zu-xQziUZ1k921+qA@mail.gmail.com/T/#mc251816dfcb7d4dcbf07368f0d288dbfb1b8e1c9

[2] https://www.phoronix.com/image-viewer.php?id=2026&image=ntfs3_root_lrg

[3] https://www.phoronix.com/news/Linux-7.2-NTFS-Improvements