GCVE - cpe:2.3:a:google:fscrypt:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:google:fscrypt:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Google (`f181d1eb-7269-5bae-b76e-e66ceb214562`)
Product	Fscrypt (`c838216c-8d4e-58d2-95c7-0c1f4e729353`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/fscrypt`	purl2cpe	2026-06-01 10:16:37.607420
`pkg:deb/ubuntu/fscrypt`	purl2cpe	2026-06-01 10:16:37.607421
`pkg:github/google/fscrypt`	purl2cpe	2026-06-01 10:16:37.607423
`pkg:rpm/opensuse/fscrypt`	purl2cpe	2026-06-01 10:16:37.607424

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-25328`	vulnerable	2026-06-08 05:41:45.725072	Privilege escalation through command injection in fscrypt MEDIUM (5) The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escalate their privileges if they create a malicious mountpoint path and if the system administrator happens to be using the fscrypt bash completion script to complete mountpoint paths. We recommend upgrading to version 0.3.3 or above Published: 2022-02-25T11:00:15.758Z Updated: 2025-04-21T13:56:13.459Z Open on db.gcve.eu Reference links https://github.com/google/fscrypt/pull/346	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-25327`	vulnerable	2026-06-08 05:41:45.724352	Local Denial of Service in fscrypt PAM module MEDIUM (5.5) The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above Published: 2022-02-25T11:00:14.437Z Updated: 2025-04-21T13:56:22.478Z Open on db.gcve.eu Reference links https://github.com/google/fscrypt/pull/346	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-25326`	vulnerable	2026-06-08 05:41:45.723670	Denial of Service in fscrypt MEDIUM (5.5) fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable. Published: 2022-02-25T11:00:13.023Z Updated: 2025-04-21T13:56:31.289Z Open on db.gcve.eu Reference links https://github.com/google/fscrypt/pull/346	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-6558`	vulnerable	2026-06-08 05:11:53.971524	Details available The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam). Published: 2018-08-23T20:00:00.000Z Updated: 2024-09-17T02:06:50.219Z Open on db.gcve.eu Reference links https://github.com/google/fscrypt/issues/77 https://github.com/google/fscrypt/commit/3022c1603d968c22f147b4a2c49c4637dd1be91b https://github.com/google/fscrypt/commit/315f9b042237200174a1fb99427f74027e191d66 https://launchpad.net/bugs/1787548	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.