Privilege Escalation Vulnerability in fscrypt Package
Summary
CVE-2022-25328: The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. Affects fscrypt versions < f28f2be05de938b1c2da7a88569bf6611250a9e2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fscrypt is a utility for managing filesystem encryption on Linux systems. It provides a way for users to encrypt their files and directories, ensuring data security and privacy. However, the bash_completion script associated with fscrypt has a vulnerability that allows local users to inject commands via crafted mountpoint paths, potentially leading to privilege escalation.
Vulnerability Detail
The vulnerability, identified as CVE-2022-25328, arises from the fscrypt bash_completion script, which does not properly sanitize mountpoint paths. A local user with control over these paths can create a malicious mountpoint that, when completed by a system administrator using the script, executes arbitrary commands. This can lead to unauthorized privilege escalation, allowing the attacker to gain higher access rights on the system. The CVSS score for this vulnerability is 7.3, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the fscrypt bash_completion script until the package is updated. This can be done by disabling bash completion for fscrypt commands or by using the command line without relying on the completion feature.
Conclusion
The CVE-2022-25328 vulnerability in the fscrypt package poses a significant risk of privilege escalation through command injection. Users are strongly advised to upgrade to the latest version to mitigate this risk. For those unable to upgrade immediately, temporary workarounds are available.
See every vulnerability recorded for fscrypt →
FAQ
CVE-2022-25328 is a vulnerability in the fscrypt package that allows local users to escalate privileges through command injection via crafted mountpoint paths.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring installation.
The primary risk is unauthorized privilege escalation, which can allow attackers to gain higher access rights and potentially compromise the entire system.
Yes, upgrading to fscrypt version 0.3.3 or above addresses this vulnerability.
If an immediate upgrade is not possible, consider disabling the fscrypt bash_completion script as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for fscrypt.
