CVE-2023-52890

What it actually does

Use-after-free vulnerability in the ntfs_uppercase_mbs function within libntfs-3g/unistr.c that can result in memory corruption during Unicode string processing on mounted NTFS volumes.

Why it matters to the business

Limited local impact on systems that mount Windows-formatted storage, potentially allowing a low-privileged user to read or alter small amounts of data or cause application instability; low urgency given stable low exploit probability and no observed campaigns.

How an attack unfolds

An attacker with local access crafts or manipulates NTFS metadata or filenames that trigger repeated calls to ntfs_uppercase_mbs, freeing a buffer that is later reused, leading to limited read/write or denial-of-service effects; exploitation is considered challenging due to timing and access requirements.

How to fix it

Upgrade NTFS-3G to a build containing commit 75dcdc2 or later; rebuild dependent packages that statically link libntfs-3g and verify the updated library is loaded at runtime.

How to confirm the fix worked

Confirm the installed ntfs-3g binary or library reports a version or commit hash at or after 75dcdc2; run targeted filesystem enumeration tests on sample NTFS images while monitoring for crashes or unexpected behavior.

Typical attack path

1. Obtain local user access on a system using NTFS-3G
2. Prepare or modify an NTFS volume containing specially chosen filenames or attributes
3. Mount the volume or perform directory enumeration/listing operations that invoke ntfs_uppercase_mbs
4. Trigger repeated processing to induce the use-after-free condition
5. Leverage resulting memory state for limited information disclosure or corruption

How to detect it

Review system logs for ntfs-3g crashes or segmentation faults during mount or directory operations; examine process core dumps or memory sanitizer reports that reference unistr.c or ntfs_uppercase_mbs; correlate with local user activity on NTFS mounts.

What your security team should do

• Inventory all systems and containers that include or depend on NTFS-3G and schedule upgrades
• Apply the fix during the next maintenance window given the low EPSS and absence from known exploited lists
• Restrict local user access to removable or network-mounted NTFS volumes where feasible
• Monitor vendor advisories for downstream package updates in distributions