Bug 1226007 (CVE-2023-52890) - VUL-0: CVE-2023-52890: ntfs-3g_ntfsprogs: use-after-free in 'ntfs_uppercase_mbs' in unistr.c
Summary: VUL-0: CVE-2023-52890: ntfs-3g_ntfsprogs: use-after-free in 'ntfs_uppercase_m...
Status: IN_PROGRESS
Alias: CVE-2023-52890
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Michael Gorse
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/408784/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-52890:4.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-06-05 12:23 UTC by Andrea Mattiazzo
Modified: 2024-06-18 16:30 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Andrea Mattiazzo 2024-06-05 12:23:35 UTC 
Use after free in ntfs_uppercase_mbs() of libntfs-3g

If 'utf8_to_unicode' throws an error due to an invalid UTF-8 sequence,
then 'n' will be less than 0 and the loop will terminate without storing
anything in '*t'. After the loop the uppercase string's allocation is
freed, however after it is freed it is unconditionally accessed through
'*t', which points into the freed allocation, for the purpose of NULL-
terminating the string. This leads to a use-after-free.
Fixed by only NULL-terminating the string when no error has been thrown.

References:
https://github.com/tuxera/ntfs-3g/issues/84

Patch:
https://github.com/tuxera/ntfs-3g/commit/75dcdc2cf37478fad6c0e3427403d198b554951d
Comment 1 Andrea Mattiazzo 2024-06-05 12:27:35 UTC 
Tracking as affected:
- openSUSE:Factory/ntfs-3g_ntfsprogs
- SUSE:ALP:Source:Standard:1.0/ntfs-3g_ntfsprogs
- SUSE:SLE-15:Update/ntfs-3g_ntfsprogs
- SUSE:SLE-12:Update/ntfs-3g_ntfsprogs
Comment 4 Marcus Meissner 2024-06-13 07:27:02 UTC 
CVE-2023-52890 was assigned, can you resubmit with this CVE?
Comment 7 Maintenance Automation 2024-06-18 16:30:05 UTC 
SUSE-SU-2024:2074-1: An update that solves one vulnerability can now be installed.

Category: security (moderate)
Bug References: 1226007
CVE References: CVE-2023-52890
Maintenance Incident: [SUSE:Maintenance:34324](https://smelt.suse.de/incident/34324/)
Sources used:
SUSE Linux Enterprise Software Development Kit 12 SP5 (src):
 ntfs-3g_ntfsprogs-2022.5.17-5.20.1
SUSE Linux Enterprise Workstation Extension 12 12-SP5 (src):
 ntfs-3g_ntfsprogs-2022.5.17-5.20.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.