CVE-2021-33287 — Out-of-bounds Write in Ntfs-3g
Severity
7.8HIGHNVD
EPSS
0.0%
top 94.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedSep 7
Latest updateMay 24
Description
In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of service of the application.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages2 packages
Also affects: Debian Linux 10.0, 11.0, 9.0, Fedora 33, 35
🔴Vulnerability Details
3📋Vendor Advisories
3Microsoft▶
In NTFS-3G versions < 2021.8.22 when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i a heap buffer overflow can occur and allow for writing to arbitrary memory or denial o↗2021-09-14
Red Hat▶
ntfs-3g: Heap buffer overflow in ntfs_attr_pread_i() triggered by specially crafted NTFS attributes↗2021-08-30
Debian▶
CVE-2021-33287: ntfs-3g - In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read...↗2021