CVE-2022-25326: Denial of Service in fscrypt
fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25326?
CVE-2022-25326 is classified as a high severity vulnerability due to its potential for allowing unprivileged users to exhaust filesystem space.
How do I fix CVE-2022-25326?
To fix CVE-2022-25326, upgrade to fscrypt version 0.3.3 or above and adjust the permissions on existing fscrypt metadata directories.
What impact does CVE-2022-25326 have on security?
The vulnerability can lead to denial of service by allowing unprivileged users to create a world-writable directory that consumes filesystem space.
Which versions of fscrypt are affected by CVE-2022-25326?
CVE-2022-25326 affects fscrypt versions up to and including 0.3.2.
Who is affected by CVE-2022-25326?
Any user or organization utilizing fscrypt version 0.3.2 or older in their filesystem setup is affected by CVE-2022-25326.