Vulnerability · Published Feb 25, 2022 · Assigned by Google

CVE-2022-25328Privilege escalation through command injection in fscrypt

Medium 5.0

In plain English

A medium-severity OS command injection in fscrypt from Google LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.2%top 89.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escalate their privileges if they create a malicious mountpoint path and if the system administrator happens to be using the fscrypt bash completion script to complete mountpoint paths. We recommend upgrading to version 0.3.3 or above

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	fscrypt	0.3.3-1	DEBIAN-CVE-2022-25328
Debian:13	fscrypt	0.3.3-1	DEBIAN-CVE-2022-25328
Debian:14	fscrypt	0.3.3-1	DEBIAN-CVE-2022-25328
Go	github.com/google/fscrypt	0.3.3	GHSA-wxjg-p59j-6c92
Ubuntu:22.04:LTS	fscrypt	0.3.3-1	UBUNTU-CVE-2022-25328

Affected products (as reported)

Vendor	Product	Versions
Google LLC	fscrypt	unspecified – through 0.3.2

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

References

https://github.com/google/fscrypt/pull/346 x_refsource_MISC