Google Fscrypt vulnerabilities

4 CVEs affecting Google Fscrypt, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-25328, published 2022-02-25.

More from Google.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-6558, published 2018-08-23. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a…
• CVE-2022-25328, published 2022-02-25. High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days. The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control…
• CVE-2022-25326, published 2022-02-25. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or…
• CVE-2022-25327, published 2022-02-25. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a…