i don't get it https://www.phoronix.com/news/NTFS3-Vulnerability-For-Root

is this another of those slop vulns that don't make any sense

this just sounds like "mounting a volume with a suid executable on it and running it gets you suid" which, well, yes?

"Desktop automounters (udisks) mount NTFS with suid by default, so plugging in a crafted USB gives any local user euid=0." is also entirely wrong as the udisks documentation says:

 "Apart from the final computed options UDisks always adds the following options due to security concerns: nodev, nosuid, uhelper=udisks2 no matter if included in _allow or not. These are hardcoded and can't be changed. "

and i verified that:

/dev/sda1 on /run/media/q66/7B4A9E4B69BF5DA5 type ntfs3 (rw,nosuid,nodev,relatime,uid=1000,gid=1000,iocharset=utf8,prealloc,uhelper=udisks2

@q66 "This loads S_ISUID/S_ISGID directly from untrusted on-disk data."

I mean... each removable storage device is untrusted data? 🙃

Like if I ship you an USB flash drive, with a malware on it, it's suid or chmod +x or whatever, and you start it, is this now a kernel vuln? Impressive

@karolherbst the other part that was previously patched was a legitimate vulnerability afaict (you could write the permission xattrs that the driver trusts as a user, ie without being restricted to root like eg the system namespace)

the rest of it is some sloperator fever dream

@q66 "oh no `chmod +s pwn` gives `pwn` setuid and root!!!!!"