CVE-2022-30785

Aliases:DEBIAN-CVE-2022-30785ALPINE-CVE-2022-30785
Advisory lineage Upstream: 0 Downstream: 10
Modified
Published: 26 May 2022, 00:00
Last modified:03 Aug 2024, 06:56

Vulnerability Summary

Overall Risk (default)
medium
29/100
CVSS Score
7.2 HIGH
v2.0 (nvd)
EPSS Score
0.4% LOW
0% probability +0.37%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

26 May 2022, 00:00
Published
Vulnerability first disclosed
03 Aug 2024, 06:56
Last Modified
Vulnerability information updated

Description

A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.7CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 7.2AV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 0.40%• Percentile: 34%

Affected Systems

  • alpine•ntfs-3g

    < 2022.5.17-r0 | < 2022.5.17-r0 | < 2022.5.17-r0 | < 2022.5.17-r0 | < 2022.5.17-r0 | < 2022.5.17-r0 | < 2022.5.17-r0 | < 2022.5.17-r0 | < 2022.5.17-r0

  • debian•ntfs-3g

    < 1:2017.3.23AR.3-4+deb11u2 | < 1:2022.5.17-1 | < 1:2022.5.17-1 | < 1:2022.5.17-1

  • debian•debian_linux

    9.0 | 10.0 | 11.0

  • fedoraproject•fedora

    35 | 36

  • tuxera•ntfs-3g

    ≤ 2021.8.22

References (12)