CVE-2023-52890: 
CBL Mariner vulnerability analysis and mitigation

NTFS-3G, prior to commit 75dcdc2, contains a use-after-free vulnerability in the ntfs_uppercase_mbs function located in libntfs-3g/unistr.c. The vulnerability was assigned CVE-2023-52890 and was publicly disclosed in June 2024. The issue affects multiple versions of the NTFS-3G package across various Linux distributions, including Ubuntu versions from 16.04 LTS through 24.04 LTS (Ubuntu CVE).

The vulnerability is characterized as a use-after-free condition in the ntfs_uppercase_mbs function within the libntfs-3g/unistr.c file. The issue has been assigned a low priority by Ubuntu security teams, indicating that exploitation of this vulnerability would be challenging (Ubuntu CVE).

While the vulnerability exists in the NTFS-3G codebase, the actual impact is considered limited. Security teams have noted that exploitation of this vulnerability would likely be difficult, which has influenced its low priority classification (Ubuntu CVE).

According to security assessments, the exploitation of this vulnerability is considered challenging. This assessment is based on discussions in the upstream bug tracker and analysis by security teams (Ubuntu CVE).

The vulnerability has been fixed in the upstream NTFS-3G repository with commit 75dcdc2. However, many distributions still remain vulnerable and await patches. For Ubuntu systems, the fix has not yet been backported to affected versions ranging from 16.04 LTS to 24.04 LTS (Ubuntu CVE).