[Bug 2093314] New: CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value

https://bugzilla.redhat.com/show_bug.cgi?id=2093314

Bug ID: 2093314
           Summary: CVE-2022-30784 ntfs-3g: crafted NTFS image can cause
                    heap exhaustion in ntfs_get_attribute_value
           Product: Security Response
          Hardware: All
                OS: Linux
            Status: NEW
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail],
                    [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail]
  Target Milestone: ---
    Classification: Other

A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in
NTFS-3G through 2021.8.22.

References:
https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x
https://github.com/tuxera/ntfs-3g/releases

[Bug 2093314] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value

https://bugzilla.redhat.com/show_bug.cgi?id=2093314

Guilherme de Almeida Suckevicz  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |2093315, 2093319, 2093317,
                   |                            |2093318, 2093316

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=2093315
[Bug 2093315] CVE-2022-30784 ntfs-3g-system-compression: ntfs-3g: crafted NTFS
image can cause heap exhaustion in ntfs_get_attribute_value [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2093316
[Bug 2093316] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap
exhaustion in ntfs_get_attribute_value [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2093317
[Bug 2093317] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap
exhaustion in ntfs_get_attribute_value [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2093318
[Bug 2093318] CVE-2022-30784 ntfs2btrfs: ntfs-3g: crafted NTFS image can cause
heap exhaustion in ntfs_get_attribute_value [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2093319
[Bug 2093319] CVE-2022-30784 ntfs-3g-system-compression: ntfs-3g: crafted NTFS
image can cause heap exhaustion in ntfs_get_attribute_value [fedora-all]

[Bug 2093314] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value

https://bugzilla.redhat.com/show_bug.cgi?id=2093314

--- Comment #1 from Guilherme de Almeida Suckevicz  ---
Created ntfs-3g tracking bugs for this issue:

Affects: epel-all [bug 2093317]
Affects: fedora-all [bug 2093316]

Created ntfs-3g-system-compression tracking bugs for this issue:

Affects: epel-all [bug 2093315]
Affects: fedora-all [bug 2093319]

Created ntfs2btrfs tracking bugs for this issue:

Affects: fedora-all [bug 2093318]

[Bug 2093314] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value

https://bugzilla.redhat.com/show_bug.cgi?id=2093314

Guilherme de Almeida Suckevicz  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |2093356

[Bug 2093314] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value

https://bugzilla.redhat.com/show_bug.cgi?id=2093314
Bug 2093314 depends on bug 2093316, which changed state.

Bug 2093316 Summary: CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2093316

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA

[Bug 2093314] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value

https://bugzilla.redhat.com/show_bug.cgi?id=2093314
Bug 2093314 depends on bug 2093319, which changed state.

Bug 2093319 Summary: CVE-2022-30784 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2093319

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA

[Bug 2093314] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value

https://bugzilla.redhat.com/show_bug.cgi?id=2093314
Bug 2093314 depends on bug 2093317, which changed state.

Bug 2093317 Summary: CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2093317

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA

[Bug 2093314] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value

https://bugzilla.redhat.com/show_bug.cgi?id=2093314

Guilherme de Almeida Suckevicz  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
   Fixed In Version|                            |ntfs-3g 2022.5.17

[Bug 2093314] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value

https://bugzilla.redhat.com/show_bug.cgi?id=2093314

--- Doc Text *updated* by Guilherme de Almeida Suckevicz  ---
A vulnerability was found in NTFS-3G. Incorrect validation of NTFS metadata can result in a heap exhaustion when processing a crafted NTFS image file or partition.

[Bug 2093314] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value

https://bugzilla.redhat.com/show_bug.cgi?id=2093314

Guilherme de Almeida Suckevicz  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |2127239, 2127236, 2127237,
                   |                            |2127233, 2127235, 2127234,
                   |                            |2127238

[Bug 2093314] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value

https://bugzilla.redhat.com/show_bug.cgi?id=2093314
Bug 2093314 depends on bug 2093318, which changed state.

Bug 2093318 Summary: CVE-2022-30784 ntfs2btrfs: ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2093318

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |NOTABUG

[Bug 2093314] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value

https://bugzilla.redhat.com/show_bug.cgi?id=2093314

--- Comment #3 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Enterprise Linux 9

Via RHSA-2023:2179 https://access.redhat.com/errata/RHSA-2023:2179

[Bug 2093314] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value

https://bugzilla.redhat.com/show_bug.cgi?id=2093314

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2023:2179

[Bug 2093314] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value

https://bugzilla.redhat.com/show_bug.cgi?id=2093314

--- Comment #4 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Enterprise Linux 8

Via RHSA-2023:2757 https://access.redhat.com/errata/RHSA-2023:2757

[Bug 2093314] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value

https://bugzilla.redhat.com/show_bug.cgi?id=2093314

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2023:2757

[Bug 2093314] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value

https://bugzilla.redhat.com/show_bug.cgi?id=2093314

--- Comment #5 from Product Security DevOps Team  ---
This bug is now closed. Further updates for individual products will be
reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-30784

[Bug 2093314] CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value

https://bugzilla.redhat.com/show_bug.cgi?id=2093314

Product Security DevOps Team  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |ERRATA
        Last Closed|                            |2023-05-17 01:11:23