CVE-2022-25327: Local Denial of Service in fscrypt PAM module
The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25327?
CVE-2022-25327 is classified as a denial of service vulnerability.
How do I fix CVE-2022-25327?
To mitigate CVE-2022-25327, update Google fscrypt to version 0.3.3 or later.
Who is affected by CVE-2022-25327?
Local users on systems using Google fscrypt versions before 0.3.3 are affected by CVE-2022-25327.
What type of vulnerability is CVE-2022-25327?
CVE-2022-25327 is a local denial of service vulnerability allowing user account lockout.
Can CVE-2022-25327 be exploited remotely?
CVE-2022-25327 cannot be exploited remotely as it requires local user access to create malicious metadata files.