CVE-2018-6558: Privilege Escalation in fscrypt
(updated )
The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam).
References
- github.com/advisories/GHSA-qj26-7grj-whg3
- github.com/google/fscrypt/commit/3022c1603d968c22f147b4a2c49c4637dd1be91b
- github.com/google/fscrypt/commit/315f9b042237200174a1fb99427f74027e191d66
- github.com/google/fscrypt/issues/77
- launchpad.net/bugs/1787548
- nvd.nist.gov/vuln/detail/CVE-2018-6558
- pkg.go.dev/vuln/GO-2020-0027
Code Behaviors & Features
Detect and mitigate CVE-2018-6558 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →