CVE-2022-25328 - Privilege escalation through command injection in fscrypt

Back Back to CVE browser

HIGH

Privilege escalation through command injection in fscrypt

Published Feb 25, 2022

7.3

HIGH

CVSS 3.1

EPSS 0.20%

Description

The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escalate their privileges if they create a malicious mountpoint path and if the system administrator happens to be using the fscrypt bash completion script to complete mountpoint paths. We recommend upgrading to version 0.3.3 or above

Affected products

Vendor Google LLC Product Fscrypt Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=0.3.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Google LLC

Fscrypt

n/a

Version	Status	Constraints
unspecified	affected	<=0.3.2

Ecosystem	Package	Introduced	Fixed
Go	github.com/google/fscrypt	0	0.3.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1242
Advisory
https://github.com/advisories/GHSA-wxjg-p59j-6c92
Advisory
https://github.com/google/fscrypt/pull/346
x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-25328

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1242		Advisory
https://github.com/advisories/GHSA-wxjg-p59j-6c92		Advisory
https://github.com/google/fscrypt/pull/346		x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-25328