The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escalate their privileges if they create a malicious mountpoint path and if the system administrator happens to be using the fscrypt bash completion script to complete mountpoint paths. We recommend upgrading to version 0.3.3 or above
References
Link | Resource |
---|---|
https://github.com/google/fscrypt/pull/346 | Patch Third Party Advisory |
Configurations
History
07 Mar 2022, 17:25
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-78 | |
CPE | cpe:2.3:a:google:fscrypt:*:*:*:*:*:*:*:* | |
First Time |
Google
Google fscrypt |
|
References | (CONFIRM) https://github.com/google/fscrypt/pull/346 - Patch, Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : 7.2
v3 : 7.3 |
25 Feb 2022, 12:57
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-02-25 11:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-25328
Mitre link : CVE-2022-25328
CVE.ORG link : CVE-2022-25328
JSON object : View
Products Affected
- fscrypt
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')