CVE-2018-6558: Privilege Escalation in fscrypt
Summary
CVE-2018-6558: Privilege Escalation in fscrypt. Affects github.com/google/fscrypt versions < 0.2.4. Fixed in 0.2.4. How to fix ↓
Also tracked for
- fscrypt · Debian:11
The same CVE-2018-6558 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fscrypt package is a Go library that provides a simple API for encrypting and decrypting files using the Linux kernel's filesystem-level encryption feature. It is primarily used to protect sensitive data stored on disk. The vulnerability identified as CVE-2018-6558 allows attackers to gain privileges by exploiting a flaw in the pam_fscrypt module, which is used by certain applications that utilize Linux-PAM for authentication.
Vulnerability Detail
The pam_fscrypt module in fscrypt before version 0.2.4 incorrectly restores primary and supplementary group IDs to the values associated with the root user. This flaw can be exploited through successful login attempts made via specific applications that rely on Linux-PAM. By leveraging this vulnerability, attackers can escalate their privileges and potentially gain unauthorized access to sensitive system resources. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.5.
How To Fix
Latest published version: v0.3.7 as of 22 Oct 2026
go get github.com/google/fscrypt@v0.3.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.2.4
This is the first release that contains the fix.
go get github.com/google/fscrypt@v0.2.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by updating the fscrypt package to the recommended version.
Conclusion
In conclusion, the CVE-2018-6558 vulnerability in the fscrypt package allows attackers to escalate privileges by exploiting a flaw in the pam_fscrypt module. To mitigate this vulnerability, it is crucial to update the fscrypt package to version 0.2.4 or later. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/google/fscrypt →
FAQ
fscrypt is a Go library that provides an API for file-level encryption on Linux systems.
This vulnerability allows attackers to gain elevated privileges, potentially leading to unauthorized access to sensitive system resources.
To fix this vulnerability, update the fscrypt package to version 0.2.4 or later.
No, there is no known workaround for this vulnerability. Updating to the fixed version is necessary.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.5.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/google/fscrypt.
