Denial of Service Vulnerability in fscrypt PAM Module
Summary
CVE-2022-25327: The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. Affects fscrypt versions < f28f2be05de938b1c2da7a88569bf6611250a9e2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fscrypt is a package used in Linux systems to manage file system encryption. It provides a way to encrypt files and directories using various encryption algorithms. The PAM (Pluggable Authentication Module) for fscrypt is responsible for handling user authentication in relation to encrypted file systems. This package is crucial for maintaining the security and privacy of user data, but it has been found to have a vulnerability that can be exploited by local users.
Vulnerability Detail
The vulnerability, identified as CVE-2022-25327, arises from inadequate validation of fscrypt metadata files by the PAM module. This flaw allows malicious users to create specially crafted metadata files that can prevent other users from logging into the system, leading to a denial of service. The issue is particularly concerning as it can be exploited by any local user, potentially locking out legitimate users and disrupting system operations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, system administrators can restrict access to the fscrypt functionality for untrusted users until the package is updated. This can be done by modifying user permissions or using access control lists (ACLs) to limit who can create or modify fscrypt metadata files.
Conclusion
The CVE-2022-25327 vulnerability in the fscrypt PAM module poses a significant risk by allowing local users to disrupt access for others. Upgrading to the latest version is essential to mitigate this risk and ensure the security of user data.
See every vulnerability recorded for fscrypt →
FAQ
CVE-2022-25327 is a vulnerability in the fscrypt PAM module that allows local users to create malicious metadata files, leading to a denial of service for other users.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The primary consequence is a denial of service, where legitimate users may be unable to log into the system due to maliciously crafted metadata files.
Yes, upgrading to version 0.3.3 or above will resolve the vulnerability.
If immediate upgrading is not possible, consider restricting access to fscrypt functionalities for untrusted users as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for fscrypt.
