World-Writable Directory Vulnerability in fscrypt Package
Summary
DEBIAN-CVE-2022-25326: fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. Affects fscrypt versions < 0.3.3-1. Fixed in 0.3.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fscrypt is a tool used in Linux systems to manage filesystem encryption. It allows users to encrypt directories and files, providing an additional layer of security for sensitive data. However, versions prior to 0.3.3 have a critical vulnerability that creates a world-writable directory by default when setting up a filesystem. This misconfiguration can lead to unauthorized access and potential denial of service by allowing unprivileged users to exhaust filesystem space.
Vulnerability Detail
The vulnerability in fscrypt arises from its default behavior of creating a world-writable directory during filesystem setup. This flaw allows any user, regardless of their privileges, to write to this directory, which can lead to a situation where the filesystem becomes full. The issue is present in all versions up to and including 0.3.2. If exploited, this vulnerability can result in service disruption and unauthorized data manipulation, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
0.3.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade fscryptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually change the permissions of the world-writable directory created by fscrypt. This can be done using the command: 'chmod 700 /path/to/fscrypt/directory', replacing '/path/to/fscrypt/directory' with the actual path to the fscrypt metadata directory.
Conclusion
The fscrypt package has a critical vulnerability that allows the creation of a world-writable directory by default, posing risks of unauthorized access and filesystem exhaustion. Users are strongly advised to upgrade to version 0.3.3 or higher and to adjust permissions on existing directories to mitigate this risk.
See every vulnerability recorded for fscrypt →
FAQ
fscrypt is a tool for managing filesystem encryption in Linux, allowing users to encrypt directories and files.
Versions of fscrypt prior to 0.3.3, specifically up to and including 0.3.2, are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities. Visit Vulert Scanner to check your application without any signup.
Exploiting this vulnerability can lead to unauthorized access to filesystem space, potentially causing service disruptions and data manipulation.
Run the command 'sudo apt-get install fscrypt=0.3.3-1' in your terminal to upgrade to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for fscrypt.
