Recently, the first feature-rich NTFS implementation, NTFS3, has been upstreamed to Linux. Although ensuring the security of NTFS3 is essential for the future of Linux, it remains unclear, however, whether the most recent version of NTFS for Linux contains 0-day vulnerabilities. To this end, we implemented Papora, the first effective fuzzer for NTFS3. We have identified and reported 3 CVE-assigned 0-day vulnerabilities and 9 severe bugs in NTFS3. Furthermore, we have investigated the underlying causes as well as types of these vulnerabilities and bugs. We have conducted an empirical study on the identified bugs while the results of our study have offered practical insights regarding the security of NTFS3 in Linux.
翻译：近期，第一个功能丰富的NTFS实现-NTFS3已经被上游到Linux。尽管确保NTFS3的安全对Linux未来至关重要，但最近的Linux NTFS版本是否包含0日漏洞仍不清楚。为此，我们实现了Papora，第一个对NTFS3有效的fuzzer。我们已经在NTFS3中发现并报告了3个CVE分配的0日漏洞和9个严重错误。此外，我们还调查了这些漏洞和错误的潜在原因和类型。我们对已经发现的错误进行了经验性研究，研究结果为Linux中的NTFS3安全提供了实用的见解。
相关内容
微信扫码咨询专知VIP会员