CVE-2022-25326: Uncontrolled Resource Consumption in github.com/google/fscrypt

February 26, 2022 (updated March 1, 2022)

fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable.

References

github.com/advisories/GHSA-mpq4-rjj8-fjph
github.com/google/fscrypt/pull/346
nvd.nist.gov/vuln/detail/CVE-2022-25326

Code Behaviors & Features

Detect and mitigate CVE-2022-25326 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →