CVE-2022-25326: Possible filesystem space exhaustion in github.com/google/fscrypt
Summary
CVE-2022-25326: Possible filesystem space exhaustion by local users in github.com/google/fscrypt. Affects github.com/google/fscrypt versions < 0.3.3. Fixed in 0.3.3. How to fix ↓
Also tracked for
- fscrypt · Debian:11
The same CVE-2022-25326 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/google/fscrypt, which is written in Go. fscrypt is a library that provides a simple API for encrypting and decrypting files on Linux using the Linux kernel's fscrypt subsystem. It aims to make it easy for developers to add file encryption capabilities to their applications. However, a vulnerability has been identified in this package that could potentially lead to filesystem space exhaustion by local users.
Vulnerability Detail
The vulnerability in github.com/google/fscrypt allows local users to exhaust the filesystem space. This can be exploited by an attacker with local access to the system to fill up the filesystem, causing denial of service for other users and potentially leading to system instability. The vulnerability arises from a flaw in the implementation of the filesystem encryption functionality. By repeatedly encrypting and decrypting files, an attacker can consume all available disk space, rendering the system unusable.
How To Fix
Latest published version: v0.3.7 as of 22 Oct 2026
go get github.com/google/fscrypt@v0.3.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.3
This is the first release that contains the fix.
go get github.com/google/fscrypt@v0.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of github.com/google/fscrypt as soon as possible.
Conclusion
The vulnerability in github.com/google/fscrypt allows local users to exhaust the filesystem space, leading to denial of service and potential system instability. Users are advised to update to version 0.3.3 or later to mitigate this vulnerability.
See every vulnerability recorded for github.com/google/fscrypt →
FAQ
The vulnerability allows local users to exhaust the filesystem space, leading to denial of service for other users and potential system instability.
Users of applications that utilize github.com/google/fscrypt for filesystem encryption are affected by this vulnerability.
No, this vulnerability can only be exploited by local users with access to the system.
There are no known instances of this vulnerability being exploited in the wild.
No, the vulnerability lies in the implementation of github.com/google/fscrypt and can only be fixed by updating to the latest version.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/google/fscrypt.
