Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

fscrypt metadata can lock out users from logging in

CVE-2022-25327 · published 4 years ago
Summary

The login helper for fscrypt does not properly check its metadata files, so a user can create a specially crafted file that stops other users from signing in. This can cause a local denial of service on systems that use the fscrypt PAM module, such as the Google open‑source version and the Debian package. Update the software to version 0.3.3 or later to fix the problem.

What to do
  • Update github.com google to version 0.3.3.
  • Update debian fscrypt to version 0.3.3-1.
Affected software
Ecosystem VendorProductAffected versions
go github.com google < 0.3.3
Fix: upgrade to 0.3.3
Debian:12 debian fscrypt < 0.3.3-1
Fix: upgrade to 0.3.3-1
Original advisory text
Local Denial of Service in fscrypt PAM module
The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-255Credentials Management Errors
CWE-276Incorrect Default Permissions
Timeline
Published25 Feb 2022
Updated21 Oct 2026
First seen6 Mar 2026
Sources
GHSA-p93v-m2r2-4387 · GHSA
CVE-2022-25327 · OSV
DEBIAN-CVE-2022-25327 · OSV
Track software like this
Free during beta