CVE-2022-25327

Published: 25 February 2022

The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above

Priority

Cvss 3 Severity Score

5.5

Score breakdown

Status

Package	Release	Status
fscrypt Launchpad, Ubuntu, Debian	bionic	Needed
	focal	Needed
	impish	Ignored (end of life)
	jammy	Not vulnerable (0.3.3-1)
	kinetic	Not vulnerable (0.3.3-1)
	lunar	Not vulnerable (0.3.3-1)
	mantic	Not vulnerable (0.3.3-1)
	noble	Not vulnerable (0.3.3-1)
	trusty	Ignored (end of standard support)
	upstream	Released (0.3.3)
	xenial	Ignored (end of standard support)
	Patches: upstream: https://github.com/google/fscrypt/commit/1a47718420317f893831b0223153d56005d5b02b upstream: https://github.com/google/fscrypt/commit/74e870b7bd1585b4b509da47e0e75db66336e576 upstream: https://github.com/google/fscrypt/commit/b44fbe71e1e93c47050322af51725bac997641e0

Severity score breakdown

Parameter	Value
Base score	5.5
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›