*** This bug is a security vulnerability ***
Public security bug reported:
In 2019, LP: #1821250 (USN-3914-2) stopped installing ntfs-3g as setuid
root as a hardening measure, following upstream's recommendation and
CVE-2019-9755. Jammy and noble still carry that change, and oracular did
too. Since plucky, however, ntfs-3g is setuid root again: plucky (25.04)
is the first release affected since that fix, resolute is the first
affected LTS, and every series up to tenacious is affected. The Ubuntu
delta did not survive the sync from Debian and has not been reapplied
since.
[ Observed ]
Jammy and noble: on these releases the final mode depended on the
postinst, so what matters is the installed binary. Tested on the LXD
cloud images with: stat -c '%A %U %n' /usr/bin/ntfs-3g
jammy 1:2021.8.22-3ubuntu1.4 -rwxr-xr-x root /usr/bin/ntfs-3g
noble 1:2022.10.3-1.2ubuntu3.2 -rwxr-xr-x root /usr/bin/ntfs-3g
Oracular only ever published 1:2022.10.3-1.2ubuntu3. Its postinst has no
chmod and its .deb ships ./bin/ntfs-3g as -rwxr-xr-x.
Plucky onwards: the mode is shipped inside the package itself. Checked with:
pull-lp-debs ntfs-3g <series>
dpkg-deb -c ntfs-3g_*.deb | grep 'usr/bin/ntfs-3g$'
plucky 1:2022.10.3-5 -rwsr-xr-x root/root
./usr/bin/ntfs-3g
questing 1:2022.10.3-5ubuntu0.25.10.1 -rwsr-xr-x root/root
./usr/bin/ntfs-3g
resolute 1:2022.10.3-5ubuntu1.1 -rwsr-xr-x root/root
./usr/bin/ntfs-3g
stonking 1:2026.7.7-2 -rwsr-xr-x root/root
./usr/bin/ntfs-3g
tenacious 1:2026.9.28-2 -rwsr-xr-x root/root
./usr/bin/ntfs-3g
On an installed resolute system (ubuntu:26.04 in LXD), stat also shows
-rwsr-xr-x root /usr/bin/ntfs-3g.
[ Probable cause ]
The 2019 fix was implemented in debian/ntfs-3g.postinst, and the noble
changelog keeps carrying it through several merges ("d/ntfs-3g.postinst:
don't install /bin/ntfs-3g as setuid root").
Debian 1:2022.10.3-4 (August 2024, Debian #1060229) dropped
ntfs-3g.postinst because it was unreliable, and instead ships the binary
with mode 4755 in data.tar (Rules-Requires-Root: binary-targets).
Meaning, the Debian changelog describes a change in how the mode is set;
it doesn't discuss whether the binary should be setuid. The Ubuntu
change lived in the file that was removed.
The delta was still present in oracular's 1:2022.10.3-1.2ubuntu3, and in
plucky until 2025-02-15. On that date plucky's package was replaced by
Debian's 1:2022.10.3-5 through a manual sync to plucky-proposed [1], not
through the auto-sync, which skips packages with an Ubuntu delta [2].
Since Debian's package installs the binary with mode 4755, the sync
brought the setuid bit back. The Ubuntu uploads since then (the later
upload to questing, the 26.04 rebuild, and the resolute security updates
1:2022.10.3-5ubuntu1 and 1:2022.10.3-5ubuntu1.1) didn't restore it.
I was not able to find a sync request bug or a stated reason, so I can't
tell whether the 2019 policy was reconsidered at that point, or only the
mechanism was judged obsolete.
[ Why it matters ]
First off, the 2019 rationale still applies. Upstream discourages
installing ntfs-3g setuid root, and CVE-2019-9755 (USN-3914-1) showed
how a memory-safety bug in ntfs-3g turns into a local privilege
escalation when the binary is setuid root. USN-3914-2 then removed the
setuid bit in 16.04, 18.04 and 18.10 through the security pocket.
In 2026, ten memory-safety CVEs were fixed in resolute
(1:2022.10.3-5ubuntu1 and 1:2022.10.3-5ubuntu1.1): CVE-2026-40706,
CVE-2026-42617, CVE-2026-42618, CVE-2026-46569, CVE-2026-46570,
CVE-2026-46571, CVE-2026-46572, CVE-2026-56135 and CVE-2026-56136 in
libntfs-3g, and CVE-2026-42616 in ntfscat. They are fixed, but they show
this code keeps producing bugs of exactly this class.
The CVE-2026-40706 is an example of the exposure. It is already fixed,
but its description says it "allows an attacker to corrupt heap memory
in the SUID-root ntfs-3g binary by crafting a malicious NTFS image" [3].
Debian's DSA-6221-1 says of it: "A local user can take advantage of this
flaw for local root privilege escalation." [4] USN-8192-1 fixed it in
22.04, 24.04 and 25.10 with one shared description, which doesn't
mention setuid [5]. The 25.10 version it lists,
1:2022.10.3-5ubuntu0.25.10.1, is the one shown as setuid above.
LP: #1821250 judged the trade-off acceptable: it reported losing
unprivileged mounting of NTFS image files, called that an edge case, and
noted that automounting of removable volumes is unaffected and that
administrators can restore the old behaviour with dpkg-statoverride.
ntfs-3g is also preinstalled on the Ubuntu server cloud images: the
26.04 image manifest (serial 20261016) lists 1:2022.10.3-5ubuntu1.1 [6].
The minimal cloud images don't include it.
[ Suggested fix ]
Drop the "chmod 4755" from debian/rules (execute_before_dh_installdeb)
in the Ubuntu package, starting with the development series. Now that
the mode lives in data.tar, the delta stays small, and dpkg-statoverride
keeps working for administrators who want the setuid bit back, with no
postinst logic needed. For the stable series, the 2019 precedent
(USN-3914-2) may apply.
If this is the desired direction, I'm happy to prepare a debdiff for the
development series.
[ Question ]
When the package was synced, was the 2019 decision not to ship ntfs-3g
setuid root deliberately reconsidered, or was only the postinst-based
mechanism considered obsolete? If the policy still stands, I think the
delta should be restored as suggested above.
[ References ]
[1] https://lists.snapcraft.io/archives/plucky-changes/2025-February/008076.html
[2] https://ubuntu.com/project/docs/how-ubuntu-is-made/concepts/version-strings
[3] https://www.cve.org/CVERecord?id=CVE-2026-40706
[4] https://lists.debian.org/debian-security-announce/2026/msg00131.html
[5]
https://lists.ubuntu.com/archives/ubuntu-security-announce/2026-April/010453.html
[6]
https://cloud-images.ubuntu.com/releases/resolute/release-20261016/ubuntu-26.04-server-cloudimg-amd64.manifest
** Affects: ntfs-3g (Ubuntu)
Importance: Undecided
Status: New
** Tags: regression-release
** Information type changed from Public to Public Security
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2173507
Title:
ntfs-3g is setuid root again since plucky (regression of LP: #1821250)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ntfs-3g/+bug/2173507/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
