CVE-2022-30784: 
Alma Linux vulnerability analysis and mitigation

CVE-2022-30784 is a vulnerability discovered in NTFS-3G through version 2021.8.22. The vulnerability involves a crafted NTFS image that can cause heap exhaustion in the ntfsgetattribute_value function (NVD, GitHub Advisory). The issue was addressed in version 2022.5.17 released in May 2022.

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is related to incorrect validation of NTFS metadata that can result in heap exhaustion when processing a specially crafted NTFS image (GitHub Advisory).

The vulnerability could potentially allow an attacker to execute arbitrary privileged code if they have either local access and the ntfs-3g binary is setuid root, or if they have physical access to an external port on a computer configured to run the ntfs-3g binary when external storage is connected (GitHub Advisory).

The vulnerability has been fixed in NTFS-3G version 2022.5.17. Users are advised to upgrade to this version or later. Multiple Linux distributions have released security updates including Debian (DSA-5160-1), Fedora, and Gentoo (Debian Security, Gentoo Security).