CVE-2022-25327

Published: 25/02/2022 Updated: 08/03/2022

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 187

Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P

The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above

Vulnerable Product	Search on Vulmon	Subscribe to Product
google fscrypt

Debian Bug report logs - #1006485 fscrypt: CVE-2022-25326 CVE-2022-25327 CVE-2022-25328 Package: src:fscrypt; Maintainer for src:fscrypt is Debian Go Packaging Team <team+pkg-go@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 26 Feb 2022 09:36:02 UTC Severity: grave Tags: securit ...

On Thu, Feb 24, 2022 at 12:33:18PM +0100, Matthias Gerstner wrote: Thanks for doing a security review and reporting all of these! To provide some extra context for readers: "fscrypt" here refers to the userspace tool githubcom/google/fscrypt, not to the kernel side of Linux native filesystem encryption which is also sometimes called fsc ...

Hello list, in the context of a request to include Fscrypt [1] into openSUSE Tumbleweed a routine review of the package was required, as it contains a PAM module In the course of the review I discovered a number of file system management related security issues I have been reviewing Fscrypt version 031 Shortly later 032 got released, with ...

CWE-276 https://github.com/google/fscrypt/pull/346 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006485 https://nvd.nist.gov

CVE-2022-25327

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

References

Vulmon Search

About

Products

Connect