DigiNews

Tech Watch by Johan Denoyer

← Back to articles

InjectionBunny: NTFS3 SUID Injection LPE

Quality: 8/10 Relevance: 9/10

Summary

InjectionBunny details a local privilege escalation in Linux ntfs3 driven by on-disk extended attributes being assigned to inode mode without masking. A crafted NTFS image or USB drive can cause a setuid root binary to appear when mounted, enabling root execution. The article notes CVE-2026-63833 as related and recommends masking S_ISUID and S_ISGID in the kernel code as the mitigation.

🚀 Service construit par Johan Denoyer