Lucene search

GitHub Advisory DatabaseGHSA-MPQ4-RJJ8-FJPH

HistoryFeb 26, 2022 - 12:00 a.m.

Uncontrolled Resource Consumption in github.com/google/fscrypt

2022-02-2600:00:44

CWE-400

GitHub Advisory Database

github.com

github

fscrypt

unprivileged users

filesystem space

upgrade

permissions

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

Percentile

12.6%

JSON

fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable.

Affected configurations

Vulners

Node

googlefscryptRange<0.3.3

VendorProductVersionCPE
googlefscrypt*cpe:2.3:a:google:fscrypt:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
google	fscrypt	*	cpe:2.3:a:google:fscrypt::::::::

References

github.com/advisories/GHSA-mpq4-rjj8-fjph

github.com/google/fscrypt/commit/91aa3ebf42032ca783c41f9ec25d885875f66ddb

github.com/google/fscrypt/pull/346

nvd.nist.gov/vuln/detail/CVE-2022-25326

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

Percentile

12.6%

JSON

Related for GHSA-MPQ4-RJJ8-FJPH