CVE-2021-35266: 
Alma Linux vulnerability analysis and mitigation

CVE-2021-35266 affects NTFS-3G versions prior to 2021.8.22. The vulnerability was discovered in August 2021 and involves a heap buffer overflow that occurs when a specially crafted NTFS inode pathname is supplied in an NTFS image. This vulnerability affects the NTFS-3G driver, which is a read-write NTFS driver for FUSE used in various Linux distributions (NTFS Advisory, NVD).

The vulnerability is classified as a heap buffer overflow (CWE-787) with a CVSS v3.1 base score of 7.8 (High). The attack vector is local (AV:L), with low attack complexity (AC:L) and requires low privileges (PR:L). The scope is unchanged, and the vulnerability can lead to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) (NVD).

If exploited, this vulnerability can result in memory disclosure, denial of service, and potential code execution. The impact is particularly severe if the ntfs-3g binary is setuid root, as it could allow for local root privilege escalation (NTFS Advisory, Debian Advisory).

The vulnerability requires either local access with the ntfs-3g binary having setuid root privileges, or physical access to an external port on a computer configured to run the ntfs-3g binary when external storage is connected. Common attack vectors include social engineering or evil maid attacks on unattended computers (NTFS Advisory).

The primary mitigation is to upgrade to NTFS-3G version 2021.8.22 or later. Various Linux distributions have released security updates to address this vulnerability, including Debian (versions 1:2017.3.23AR.3-4+deb11u1 for bullseye), Fedora, and Gentoo (Debian Advisory, Gentoo Advisory).