Re: Fwd: InjectionBunny: NTFS3 SUID injection leading to local privilege escalation

[Salvatore Bonaccorso <carnil@debian.org>]

Hi Vladimir,

On Fri, Aug 07, 2026 at 01:39:35PM +0300, vova tokarev wrote:
> Hi,
> 
> It's been almost two months since I reported this, and I haven't heard
> back. I recently learned I should reach out to the subsystem maintainer
> directly, so forwarding this to you.
> 
> I noticed that CVE-2026-63833 (commit f8d420949b33) was assigned and
> merged for a related issue -- blocking setxattr() writes to $LX*
> names. However, this only fixes one of the two attack vectors I
> reported. The primary vector in my original report remains open:
> 
> A pre-crafted NTFS image (e.g. USB drive) with $LXUID=0, $LXGID=0,
> $LXMOD=0104755 already in the MFT produces a setuid-root binary the
> moment the volume is mounted. No setxattr() is involved -- the EAs
> are on disk. The -EPERM check doesn't help.
> 
> The root cause is still at fs/ntfs3/xattr.c:1022:
> 
>     inode->i_mode = le32_to_cpu(value[2]);
> 
> This loads S_ISUID/S_ISGID directly from untrusted on-disk data.
> Desktop automounters (udisks) mount NTFS with suid by default, so
> plugging in a crafted USB gives any local user euid=0.
> 
> Suggested one-line fix:
> 
> -   inode->i_mode = le32_to_cpu(value[2]);
> +   inode->i_mode = le32_to_cpu(value[2]) & ~(S_ISUID | S_ISGID);
> 
> I have a full PoC and working demo (included in my original report
> below). Would love to hear your thoughts.

AFAICS, this did not got a patch yet. Would you mind submitting a
patch to Konstantin? I'm adding Konstantin Komarov explicitly to this
thread.

Konstantin, context from
https://lore.kernel.org/ntfs3/CAGBKPgPiXyKWtjgYSACnugmG1XPs=mPg-Zu-xQziUZ1k921+qA@mail.gmail.com/
.

Regards,
Salvatore