NTFS3 Driver Vulnerability: A Crafted Image Grants Root on Linux

A vulnerability has been found in the NTFS3 file system driver in the Linux kernel that allows a local user to escalate privileges to root. All it takes is plugging in a USB drive with a prepared NTFS image — and an executable file with the setuid bit set, owned by the superuser, appears on the system.

How it works

The vulnerability was reported by Phoronix, citing the NTFS3 developers' mailing list. Vova Tokarev, who found the problem, explains: if you set the values $LXUID=0, $LXGID=0 and $LXMOD=0104755 in the image's MFT ahead of time, then the moment the volume is mounted the system gets a ready-made setuid-root binary. No call to setxattr() is required — the extended attributes are already on disk, so the -EPERM check never fires.

The root of the problem is a line in fs/ntfs3/xattr.c, where the file mode is read directly from untrusted on-disk data:

inode->i_mode = le32_to_cpu(value[2]);

This way the S_ISUID and S_ISGID bits are loaded straight from the image, which is controlled by the attacker. The situation is made worse by the fact that desktop auto-mounters like udisks mount NTFS with the suid option by default. As a result, any local user just needs to insert a prepared flash drive to obtain euid=0.

A fix exists, but it hasn't been applied

The author proposes a one-line patch: when reading the file mode, clear the dangerous bits with the mask & ~(S_ISUID | S_ISGID). According to him, he has a full proof-of-concept and a working demonstration of the attack.

Something else is notable: the vulnerability was reported to the developers privately about two months ago, but there was no response. Having waited in vain, the researcher disclosed the details publicly. As of the time this note was published, the main NTFS3 driver in the kernel still remains vulnerable.

There is some good news: the problem apparently does not affect the newer alternative NTFS driver that is being developed in parallel in the mainline kernel tree. Until a fix is released, users who work with NTFS partitions should be cautious about other people's drives and, where possible, disable automatic mounting with the suid flag.

Source: Phoronix