CVE-2022-25326 Denial of Service in fscrypt

2022-02-2511:00:13

CWE-400

Google

www.cve.org

denial of service

fscrypt

filesystem space

unprivileged users

upgrade

permissions

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

Percentile

12.6%

JSON

fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable.

CNA Affected

[
  {
    "product": "fscrypt",
    "vendor": "Google LLC",
    "versions": [
      {
        "lessThanOrEqual": "0.3.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]