Lucene search

GoogleCVE-2022-25326

HistoryFeb 25, 2022 - 11:15 a.m.

CVE-2022-25326

2022-02-2511:15:08

CWE-400

Google

web.nvd.nist.gov

cve-2022-25326

fscrypt

filesystem

vulnerability

nvd

security

upgrade

permissions

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

5.3

Confidence

High

EPSS

Percentile

12.6%

JSON

fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable.

Affected configurations

Nvd

Vulners

Node

googlefscryptRange≤0.3.2

VendorProductVersionCPE
googlefscrypt*cpe:2.3:a:google:fscrypt:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
google	fscrypt	*	cpe:2.3:a:google:fscrypt::::::::

CNA Affected

[
  {
    "product": "fscrypt",
    "vendor": "Google LLC",
    "versions": [
      {
        "lessThanOrEqual": "0.3.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/google/fscrypt/pull/346

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

5.3

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2022-25326