Name: CVE-2017-0358: Improper Privilege Management
Creator: Rapid7
Published: 2018-04-13T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2017-0358, CWE-269, Metasploit Module, CVSS 7.8, EPSS 0.07546

Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.

CVSS Details

CVSS 3.1 Base Score: 7.8
CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Debian	—	Upgrade ntfs-3g	Feb 2, 2017	Feb 1, 2017
Gentoo Linux	—	Upgrade sys-fs/ntfs3g.	Oct 30, 2017	Feb 19, 2017
Suse	—	Upgrade libntfs-3g84Upgrade ntfs-3g-develUpgrade libntfs-3g-develUpgrade ntfs-3gUpgrade ntfsprogs	Jul 27, 2018	Feb 1, 2017
Ubuntu	—	Upgrade ntfs-3g	Feb 2, 2017	Feb 1, 2017

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence