Version in base suite: 2022.10.3-5 Base version: ntfs-3g_2022.10.3-5 Target version: ntfs-3g_2022.10.3-5+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/n/ntfs-3g/ntfs-3g_2022.10.3-5.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/n/ntfs-3g/ntfs-3g_2022.10.3-5+deb13u1.dsc changelog | 8 +++ patches/ntfs-3g_2022.10.3-cve_2026-02.patch | 59 ++++++++++++++++++++++++++++ patches/series | 1 3 files changed, 68 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpvgnvm2hj/ntfs-3g_2022.10.3-5.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpvgnvm2hj/ntfs-3g_2022.10.3-5+deb13u1.dsc: no acceptable signature found diff -Nru ntfs-3g-2022.10.3/debian/changelog ntfs-3g-2022.10.3/debian/changelog --- ntfs-3g-2022.10.3/debian/changelog 2024-10-05 07:45:48.000000000 +0000 +++ ntfs-3g-2022.10.3/debian/changelog 2026-04-16 21:27:17.000000000 +0000 @@ -1,3 +1,11 @@ +ntfs-3g (1:2022.10.3-5+deb13u1) trixie-security; urgency=high + + * Non-maintainer upload by the Security Team. + * acls.c: Fix heap buffer overflow in 'ntfs_build_permissions_posix' + (CVE-2026-40706) + + -- Salvatore Bonaccorso Thu, 16 Apr 2026 23:27:17 +0200 + ntfs-3g (1:2022.10.3-5) unstable; urgency=medium * Move fuse to simple dependency (closes: #983359). diff -Nru ntfs-3g-2022.10.3/debian/patches/ntfs-3g_2022.10.3-cve_2026-02.patch ntfs-3g-2022.10.3/debian/patches/ntfs-3g_2022.10.3-cve_2026-02.patch --- ntfs-3g-2022.10.3/debian/patches/ntfs-3g_2022.10.3-cve_2026-02.patch 1970-01-01 00:00:00.000000000 +0000 +++ ntfs-3g-2022.10.3/debian/patches/ntfs-3g_2022.10.3-cve_2026-02.patch 2026-04-16 21:25:43.000000000 +0000 @@ -0,0 +1,59 @@ +From 082a52e3c7100d452485b6c5ef648cd99fc3395c Mon Sep 17 00:00:00 2001 +From: Erik Larsson +Date: Tue, 24 Feb 2026 10:04:31 +0200 +Subject: [PATCH] acls.c: Fix heap buffer overflow in + 'ntfs_build_permissions_posix'. + +The root cause was that the memory allocated for the ACE entries was +insufficient for the worst case scenario when group entries were added +for mask entries that didn't have a corresponding group entry already. +Fixed by allocating space for the worst case number of ACE entries. + +This was reported by Andrea Bocchetti with a thorough report which made +it very easy to fix. + +This is a backport of the original patch to version 2022.10.3. +--- + libntfs-3g/acls.c | 25 ++++++++++++++++++++----- + 1 file changed, 20 insertions(+), 5 deletions(-) + +diff --git a/libntfs-3g/acls.c b/libntfs-3g/acls.c +index 9f16fecd..4cf534bf 100644 +--- a/libntfs-3g/acls.c ++++ b/libntfs-3g/acls.c +@@ -3716,12 +3716,27 @@ struct POSIX_SECURITY *ntfs_build_permissions_posix( + /* + * Build a raw posix security descriptor + * by just translating permissions and ids +- * Add 2 to the count of ACE to be able to insert +- * a group ACE later in access and default ACLs +- * and add 2 more to be able to insert ACEs for owner +- * and 2 more for other ++ * ++ * The worst case number of ACE entries consists of: ++ * - 'acecount' ACE entries from the main loop (see below) ++ * iterating over the 'securattr' array. ++ * - 1 ACE entry which may be added when creating world ++ * permissions if none exist. ++ * - 1 ACE entry which may be added when setting basic owner ++ * permissions if none exist (both lists). ++ * - 1 ACE entry which may be added when duplicating world ++ * permissions as group_obj permissions if none exist. ++ * - 'acecount + 2' ACE entries which may be added when ++ * duplicating world permissions as group permissions if they ++ * were converted to masks and the masks are not followed by a ++ * group entry. ++ * - 1 ACE entry which may be added when inserting a default ++ * mask if none is present and there are designated users or ++ * groups. ++ * ++ * This amounts to 2*acecnt + 6 ACE entries in the worst case. + */ +- alloccnt = acecnt + 6; ++ alloccnt = 2*acecnt + 6; + pxdesc = (struct POSIX_SECURITY*)malloc( + sizeof(struct POSIX_SECURITY) + + alloccnt*sizeof(struct POSIX_ACE)); +-- +2.51.0 + diff -Nru ntfs-3g-2022.10.3/debian/patches/series ntfs-3g-2022.10.3/debian/patches/series --- ntfs-3g-2022.10.3/debian/patches/series 2024-06-16 05:12:14.000000000 +0000 +++ ntfs-3g-2022.10.3/debian/patches/series 2026-04-16 21:25:43.000000000 +0000 @@ -1 +1,2 @@ Fix_use-after-free_in_ntfs_uppercase_mbs.patch +ntfs-3g_2022.10.3-cve_2026-02.patch