Bug 1226007 (CVE-2023-52890)

Summary:	VUL-0: CVE-2023-52890: ntfs-3g_ntfsprogs: use-after-free in 'ntfs_uppercase_mbs' in unistr.c
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Andrea Mattiazzo <andrea.mattiazzo>
Component:	Incidents	Assignee:	Michael Gorse <mgorse>
Status:	IN_PROGRESS ---	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	meissner, mgorse, thomas.leroy
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/408784/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-52890:4.5:(AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Andrea Mattiazzo 2024-06-05 12:23:35 UTC

Use after free in ntfs_uppercase_mbs() of libntfs-3g

If 'utf8_to_unicode' throws an error due to an invalid UTF-8 sequence,
then 'n' will be less than 0 and the loop will terminate without storing
anything in '*t'. After the loop the uppercase string's allocation is
freed, however after it is freed it is unconditionally accessed through
'*t', which points into the freed allocation, for the purpose of NULL-
terminating the string. This leads to a use-after-free.
Fixed by only NULL-terminating the string when no error has been thrown.

References:
https://github.com/tuxera/ntfs-3g/issues/84

Patch:
https://github.com/tuxera/ntfs-3g/commit/75dcdc2cf37478fad6c0e3427403d198b554951d

Comment 1 Andrea Mattiazzo 2024-06-05 12:27:35 UTC

Tracking as affected:
- openSUSE:Factory/ntfs-3g_ntfsprogs
- SUSE:ALP:Source:Standard:1.0/ntfs-3g_ntfsprogs
- SUSE:SLE-15:Update/ntfs-3g_ntfsprogs
- SUSE:SLE-12:Update/ntfs-3g_ntfsprogs

Comment 4 Marcus Meissner 2024-06-13 07:27:02 UTC

CVE-2023-52890 was assigned, can you resubmit with this CVE?

Comment 7 Maintenance Automation 2024-06-18 16:30:05 UTC

SUSE-SU-2024:2074-1: An update that solves one vulnerability can now be installed.

Category: security (moderate)
Bug References: 1226007
CVE References: CVE-2023-52890
Maintenance Incident: [SUSE:Maintenance:34324](https://smelt.suse.de/incident/34324/)
Sources used:
SUSE Linux Enterprise Software Development Kit 12 SP5 (src):
 ntfs-3g_ntfsprogs-2022.5.17-5.20.1
SUSE Linux Enterprise Workstation Extension 12 12-SP5 (src):
 ntfs-3g_ntfsprogs-2022.5.17-5.20.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.