PT-2022-17215 · Fscrypt+2 · Fscrypt+2

Matthias Gerstner · Published 2022-02-25 · Updated 2024-08-21 · CVE-2022-25327

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions fscrypt versions prior to 0.3.3

Description The PAM module for fscrypt does not adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system.

Recommendations For versions prior to 0.3.3, we recommend upgrading to version 0.3.3 or above. As a temporary workaround, consider restricting access to the creation of fscrypt metadata files to minimize the risk of exploitation.

Fix

DoS

Incorrect Default Permissions

Weakness Enumeration

CWE-255

CWE-276

Related Identifiers

ALT-PU-2023-1941

CVE-2022-25327

GHSA-8VWM-8VJ8-RQJF

GHSA-P93V-M2R2-4387

GO-2022-0340

OPENSUSE-SU-2024:11902-1

Affected Products

Alt Linux

Debian

Fscrypt

References · 26

• https://github.com/google/fscrypt/pull/346 · Patch
• https://osv.dev/vulnerability/GO-2022-0340 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11902-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-25327 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-25327 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-25327 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25327 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-25327 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8vwm-8vj8-rqjf · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p93v-m2r2-4387 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25327 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-25327 · Vendor Advisory
• https://github.com/google/fscrypt/commit/91aa3ebf42032ca783c41f9ec25d885875f66ddb · Note
• https://github.com/google/fscrypt/commit/1a47718420317f893831b0223153d56005d5b02b · Note
• https://github.com/google/fscrypt/security/advisories/GHSA-p93v-m2r2-4387 · Note