7.8

CVE-2017-0358: ntfs-3g: Modprobe influence vulnerability via environment variables

Modified
AliasesSUSE-SU-2018:2070-1SUSE-SU-2018:3587-1SUSE-SU-2018:3587-2
Published 13-04-2018Last modified 04-12-2025

Vulnerability summary

CVE-2017-0358 is a high (CVSS 7.8) Improper Privilege Management vulnerability in debian debian_linux. EPSS estimates a 2.19% chance of exploitation in the next 30 days, higher than 82.4% of scored vulnerabilities. 4 public exploits are recorded.

Priority
Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 14-02-2017)

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
2.19%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits4reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
SUSE-SU-2021:2965-1

Timeline

  1. 13-04-2018
    PublishedVulnerability first disclosed.
  2. 04-12-2025
    Last modifiedVulnerability information updated.

Description

Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.

CVSS metrics

7 scores · 4 sources · 3 versions

EPSS trend

Probability

2.19%

Chance of exploitation in the next 30 days

Percentile

82%

Versus all other CVEs

30-day change

No change 0.00 pp

From 2.19% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

4 found
  • referenceUnverified

    Exploit Reference (marc.info)

    Maturity: unknown

  • exploit-databaselocallinuxUnverified

    ntfs-3g (Debian 9) - Local Privilege Escalation

    Maturity: poc

  • exploit-databaselocallinuxVerified

    ntfs-3g - Unsanitized modprobe Environment Privilege Escalation

    Maturity: weaponized

Show all 4 exploits
  • MetasploitMetasploitremoteVerified

    Debian/Ubuntu ntfs-3g Local Privilege Escalation

    exploit/linux/local/ntfs3g_priv_esc

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse7 products
  • ntfs-3g_ntfsprogs&distro=SUSE Linux Enterprise Desktop 12 SP3< 2013.1.13-5.3.1
  • ntfs-3g_ntfsprogs&distro=SUSE Linux Enterprise Desktop 12 SP4< 2013.1.13-5.3.1
  • ntfs-3g_ntfsprogs&distro=SUSE Linux Enterprise Software Development Kit 12 SP3< 2013.1.13-5.3.1
  • ntfs-3g_ntfsprogs&distro=SUSE Linux Enterprise Software Development Kit 12 SP4< 2013.1.13-5.3.1
  • ntfs-3g_ntfsprogs&distro=SUSE Linux Enterprise Workstation Extension 12 SP3< 2013.1.13-5.3.1
Debian2 products
  • ntfs-3g< 1:2016.2.22AR.1-4 | < 1:2014.2.15AR.2-1+deb8u3 | < 1:2012.1.15AR.5-2.1+deb7u3
  • debian_linuxEOL8.0
Ntfs-3g1 product
Tuxera1 product
Ubuntu1 product
  • ntfs-3g< 1:2015.3.14AR.1-1ubuntu0.1

5 vendors · 12 products

References

16 links
Show all 16 references