CVE-2017-0358

Publication date 1 February 2017

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
ntfs-3g	16.10 yakkety	Fixed 1:2016.2.22AR.1-3ubuntu0.1
	16.04 LTS xenial	Fixed 1:2015.3.14AR.1-1ubuntu0.1
	14.04 LTS trusty	Not affected
	12.04 LTS precise	Not affected

Notes

tyhicks

14.04 and 12.04 are not affected since ntfs-3g is not installed setuid-root. While there is some debconf support for setting ntfs-3g as setuid-root in the packaging, libfuse refuses to cooperate when it detects that it is running in a setuid environment.

Severity score breakdown

Parameter	Value
Base score	7.8 · High
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H