Version in base suite: 2022.10.3-1 Base version: ntfs-3g_2022.10.3-1 Target version: ntfs-3g_2022.10.3-1+deb12u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/n/ntfs-3g/ntfs-3g_2022.10.3-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/n/ntfs-3g/ntfs-3g_2022.10.3-1+deb12u1.dsc changelog | 7 ++ patches/0001-Fix_use-after-free_in_ntfs_uppercase_mbs.patch | 34 ++++++++++++ patches/series | 1 3 files changed, 42 insertions(+) diff -Nru ntfs-3g-2022.10.3/debian/changelog ntfs-3g-2022.10.3/debian/changelog --- ntfs-3g-2022.10.3/debian/changelog 2022-10-31 14:14:06.000000000 +0000 +++ ntfs-3g-2022.10.3/debian/changelog 2024-06-23 12:34:22.000000000 +0000 @@ -1,3 +1,10 @@ +ntfs-3g (1:2022.10.3-1+deb12u1) bookworm; urgency=medium + + * Fix use-after-free in 'ntfs_uppercase_mbs' (CVE-2023-52890) + (closes: #1073248). + + -- Laszlo Boszormenyi (GCS) Sun, 23 Jun 2024 14:34:22 +0200 + ntfs-3g (1:2022.10.3-1) unstable; urgency=high * New upstream release: diff -Nru ntfs-3g-2022.10.3/debian/patches/0001-Fix_use-after-free_in_ntfs_uppercase_mbs.patch ntfs-3g-2022.10.3/debian/patches/0001-Fix_use-after-free_in_ntfs_uppercase_mbs.patch --- ntfs-3g-2022.10.3/debian/patches/0001-Fix_use-after-free_in_ntfs_uppercase_mbs.patch 1970-01-01 00:00:00.000000000 +0000 +++ ntfs-3g-2022.10.3/debian/patches/0001-Fix_use-after-free_in_ntfs_uppercase_mbs.patch 2024-06-23 11:59:41.000000000 +0000 @@ -0,0 +1,34 @@ +From 75dcdc2cf37478fad6c0e3427403d198b554951d Mon Sep 17 00:00:00 2001 +From: Erik Larsson +Date: Tue, 13 Jun 2023 17:47:15 +0300 +Subject: [PATCH] unistr.c: Fix use-after-free in 'ntfs_uppercase_mbs'. + +If 'utf8_to_unicode' throws an error due to an invalid UTF-8 sequence, +then 'n' will be less than 0 and the loop will terminate without storing +anything in '*t'. After the loop the uppercase string's allocation is +freed, however after it is freed it is unconditionally accessed through +'*t', which points into the freed allocation, for the purpose of NULL- +terminating the string. This leads to a use-after-free. +Fixed by only NULL-terminating the string when no error has been thrown. + +Thanks for Jeffrey Bencteux for reporting this issue: +https://github.com/tuxera/ntfs-3g/issues/84 +--- + libntfs-3g/unistr.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/libntfs-3g/unistr.c b/libntfs-3g/unistr.c +index 5854b3b7..db8ddf42 100644 +--- a/libntfs-3g/unistr.c ++++ b/libntfs-3g/unistr.c +@@ -1189,8 +1189,9 @@ char *ntfs_uppercase_mbs(const char *low, + free(upp); + upp = (char*)NULL; + errno = EILSEQ; ++ } else { ++ *t = 0; + } +- *t = 0; + } + return (upp); + } diff -Nru ntfs-3g-2022.10.3/debian/patches/series ntfs-3g-2022.10.3/debian/patches/series --- ntfs-3g-2022.10.3/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ ntfs-3g-2022.10.3/debian/patches/series 2024-06-23 12:11:42.000000000 +0000 @@ -0,0 +1 @@ +0001-Fix_use-after-free_in_ntfs_uppercase_mbs.patch