CVE-2022-40284

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if the ntfs-3g binary is setuid root. A physically proximate attacker can exploit this if NTFS-3G software is configured to execute upon attachment of an external storage device.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2022/10/31/2Mailing List, Third Party Advisory
https://github.com/tuxera/ntfs-3g/releasesThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00029.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BOQ7YLFT43KLXEN3EB6CS4DP635RJWP/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IA2D4PYOR7ABI7BWBMMMYKY2OPHTV2NI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGDKGXA4R2ZVUQ3CT4D4YGTFMNZQA7HW/
https://security.gentoo.org/glsa/202301-01Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/10/31/2Mailing List, Third Party Advisory
https://github.com/tuxera/ntfs-3g/releasesThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00029.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BOQ7YLFT43KLXEN3EB6CS4DP635RJWP/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IA2D4PYOR7ABI7BWBMMMYKY2OPHTV2NI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGDKGXA4R2ZVUQ3CT4D4YGTFMNZQA7HW/
https://security.gentoo.org/glsa/202301-01Third Party Advisory

Timeline

Published: Nov 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-402879.0The application was found to be vulnerable to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in messaging functionality, l CVE-2022-402889.0The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the user profile data fields, which could be leverag CVE-2022-402899.0The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the upload and download functionality, which could b CVE-2022-40294.7The Simple:Press plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sforum_[md5 hash of the WordPress URL]' cooki CVE-2022-402906.1The application was vulnerable to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the barcode generation functional CVE-2022-402918.8The application was vulnerable to Cross-Site Request Forgery (CSRF) attacks, allowing an attacker to coerce users into sending malicious req CVE-2022-402925.3The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each accou CVE-2022-402939.8The application was vulnerable to a session fixation that could be used hijack accounts.CVE-2022-402948.8The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within expo CVE-2022-402954.9The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which co CVE-2022-402969.8The application was vulnerable to a Server-Side Request Forgery attacks, allowing the backend server to interact with unexpected endpoints, CVE-2022-402977.8UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode is only four digits,