Skip to content

Possible filesystem space exhaustion by local users (CVE-2022-25326)

Moderate
ebiggers published GHSA-chxf-fjcf-7fwp Feb 26, 2022

Package

gomod fscrypt (Go)

Affected versions

<= 0.3.2

Patched versions

0.3.3

Description

fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt v0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable.

For more details, see CVE-2022-25326 and https://github.com/google/fscrypt#setting-up-fscrypt-on-a-filesystem.

Severity

Moderate

CVE ID

CVE-2022-25326

Weaknesses

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Learn more on MITRE.

Credits