Описание
The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| fscrypt | fixed | 0.3.3-1 | package | |
| fscrypt | no-dsa | bullseye | package | |
| fscrypt | no-dsa | buster | package |
Примечания
https://www.openwall.com/lists/oss-security/2022/02/24/1
https://github.com/google/fscrypt/commit/1a47718420317f893831b0223153d56005d5b02b
https://github.com/google/fscrypt/commit/74e870b7bd1585b4b509da47e0e75db66336e576
https://github.com/google/fscrypt/commit/b44fbe71e1e93c47050322af51725bac997641e0
Связанные уязвимости
The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above
The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above
User login denial of service in github.com/google/fscrypt