CVE-2022-25327

Name of the Vulnerable Software and Affected Versions fscrypt versions prior to 0.3.3

Description The PAM module for fscrypt does not adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system.

Recommendations For versions prior to 0.3.3, we recommend upgrading to version 0.3.3 or above. As a temporary workaround, consider restricting access to the creation of fscrypt metadata files to minimize the risk of exploitation.