Lucene search

K
ubuntucveUbuntu.comUB:CVE-2022-25328
HistoryFeb 25, 2022 - 12:00 a.m.

CVE-2022-25328

2022-02-2500:00:00
ubuntu.com
ubuntu.com
19
fscrypt
bash completion
privilege escalation
mountpoint paths
vulnerability
upgrade
unix

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS

0

Percentile

5.2%

The bash_completion script for fscrypt allows injection of commands via
crafted mountpoint paths, allowing privilege escalation under a specific
set of circumstances. A local user who has control over mountpoint paths
could potentially escalate their privileges if they create a malicious
mountpoint path and if the system administrator happens to be using the
fscrypt bash completion script to complete mountpoint paths. We recommend
upgrading to version 0.3.3 or above

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS

0

Percentile

5.2%