CVE-2021-33285: debian debian_linux Out-of-bounds Write

Vulnerability summary

CVE-2021-33285 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 35.9% of scored vulnerabilities.

Timeline

1. 07-09-2021
   PublishedVulnerability first disclosed.
2. 03-12-2025
   Last modifiedVulnerability information updated.

Description

In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur allowing for memory disclosure or denial of service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the "bytes_in_use" field should be less than the "bytes_allocated" field. When it is not, the parsing of the records proceeds into the wild.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.