Possible filesystem space exhaustion by local users in fscrypt
Summary
CVE-2022-25326: Possible filesystem space exhaustion by local users. Affects github.com/google/fscrypt versions < 0.3.3. Fixed in 0.3.3. How to fix ↓
Also tracked for
- fscrypt · Debian:11
The same CVE-2022-25326 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fscrypt is a Go package that provides a set of tools for managing Linux filesystem encryption. It allows users to encrypt files and directories on a filesystem using the Linux kernel's filesystem-level encryption feature. This package is commonly used to enhance the security of sensitive data stored on Linux systems. However, a vulnerability has been discovered in versions prior to v0.3.3 that could allow local users to exhaust filesystem space.
Vulnerability Detail
The vulnerability in fscrypt arises from the creation of a world-writable directory by default when setting up a filesystem. This directory can be exploited by unprivileged users to fill up the filesystem and cause a denial-of-service condition. By continuously writing data to this directory, an attacker can consume all available disk space, rendering the system unusable. This vulnerability poses a moderate risk as it requires local access to the system and can lead to service disruption or data loss.
How To Fix
Latest published version: v0.3.7 as of 22 Oct 2026
go get github.com/google/fscrypt@v0.3.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.3
This is the first release that contains the fix.
go get github.com/google/fscrypt@v0.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually adjusting the permissions on the existing fscrypt metadata directories. By restricting write access to these directories for unprivileged users, the risk of filesystem space exhaustion can be mitigated. The following command can be used to modify the permissions:
chmod 700 /path/to/fscrypt/metadata
Note that this workaround is not a permanent solution and should be followed by upgrading to the latest version as soon as possible.
Conclusion
In conclusion, the fscrypt package prior to v0.3.3 is vulnerable to a filesystem space exhaustion issue that can be exploited by local unprivileged users. To mitigate this vulnerability, it is recommended to upgrade to the latest version of fscrypt and adjust the permissions on existing metadata directories. If immediate upgrading is not possible, a temporary workaround can be implemented by manually modifying the permissions. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/google/fscrypt →
FAQ
fscrypt is a Go package that provides tools for managing Linux filesystem encryption. It allows users to encrypt files and directories on a filesystem using the Linux kernel's filesystem-level encryption feature.
This vulnerability allows unprivileged local users to exhaust filesystem space, potentially leading to a denial-of-service condition. By filling up the filesystem, the attacker can render the system unusable and cause service disruption or data loss.
To fix this vulnerability, it is recommended to upgrade to fscrypt v0.3.3 or above. This version addresses the issue by adjusting the permissions on the fscrypt metadata directories, preventing unprivileged users from exhausting filesystem space.
Yes, if upgrading to the latest version is not immediately feasible, you can manually adjust the permissions on the existing fscrypt metadata directories to restrict write access for unprivileged users. However, this workaround is temporary, and upgrading to the latest version is strongly advised.
No, this vulnerability requires local access to the system. Remote exploitation is not possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/google/fscrypt.
