CVE-2017-0358 in ntfs-3g
Summary
by MITRE
Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 12/05/2025
The vulnerability identified as CVE-2017-0358 resides within the NTFS-3G filesystem driver implementation for FUSE systems, specifically targeting the insecure handling of environment variables during privilege escalation operations. This flaw manifests in the manner in which the driver manages system calls when executing modprobe commands, creating a critical security gap that allows local attackers to exploit elevated privileges. The vulnerability was discovered by Jann Horn from Google Project Zero, highlighting the dangerous intersection of filesystem driver design and privilege management in Unix-like operating systems. The core issue stems from insufficient sanitization of environmental variables that are passed to system execution functions, creating a pathway for malicious code injection through the modprobe mechanism.
The technical exploitation of this vulnerability occurs when NTFS-3G, while processing NTFS filesystem operations, invokes modprobe with user-controllable environment variables that have not been properly sanitized. This insecure practice allows a local attacker to manipulate the environment in such a way that when modprobe executes, it loads a malicious kernel module with root privileges instead of the intended module. The flaw directly relates to CWE-78, which describes improper neutralization of special elements used in OS commands, and CWE-20, which addresses improper input validation. The vulnerability operates under the principle that environment variables can be modified by local users to influence the behavior of system commands, particularly when those commands are executed with elevated privileges. The modprobe utility, designed to automatically load kernel modules, becomes a vector for privilege escalation when environment variables containing malicious paths or parameters are not properly scrubbed before execution.
The operational impact of CVE-2017-0358 is severe and directly affects systems running NTFS-3G with FUSE support, particularly those with default configurations that allow local user access. Local privilege escalation to root level allows attackers to gain complete system control, potentially leading to data exfiltration, persistence mechanisms installation, or further network exploitation. This vulnerability aligns with ATT&CK technique T1068, which describes locally executed malicious code that exploits elevated privileges, and T1548.001, concerning abuse of privilege escalation techniques. The exploitability requires only local access to the system, making it particularly dangerous in multi-user environments where users might have legitimate access to the system but lack administrative privileges. The attack vector is relatively straightforward, involving manipulation of environment variables that are then passed to the vulnerable modprobe execution context, which can be executed in various scenarios including during file system mounting operations or when handling NTFS-specific file attributes.
Mitigation strategies for CVE-2017-0358 focus on both immediate patching and defensive configuration measures. The primary solution involves updating NTFS-3G to versions that properly sanitize environment variables before executing modprobe commands, which was addressed in subsequent releases of the software. System administrators should also implement the principle of least privilege by restricting unnecessary FUSE module usage and monitoring modprobe execution patterns. Additional defensive measures include implementing proper environment variable sanitization at the system level, configuring SELinux or AppArmor policies to restrict modprobe operations, and monitoring for suspicious modprobe invocations that may indicate exploitation attempts. The vulnerability demonstrates the importance of secure coding practices in privilege escalation paths, particularly when dealing with system-level commands that can be influenced by user-controllable inputs. Organizations should also consider implementing automated patch management systems to ensure timely deployment of security updates that address such fundamental privilege escalation flaws in filesystem drivers and system utilities.