CVE-2022-25327
Local Denial of Service in fscrypt PAM module
The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Local Denial of Service in fscrypt PAM module
The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above
- Record
CVE-2022-25327- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-255
- Updated
- 2026-11-02
EUVDEUVD-2022-0926
The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above
- Record
EUVD-2022-0926- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8vwm-8vj8-rqjf
User login denial of service in github.com/google/fscrypt
The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above
- Record
GHSA-8vwm-8vj8-rqjf- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-276
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p93v-m2r2-4387 No score
Denial of service via insufficient metadata validation
The PAM module for fscrypt through v0.3.2 doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to v0.3.3 or above.
For more details, see CVE-2022-25327.
- Record
GHSA-p93v-m2r2-4387- Updated
- 2026-11-02
NVD
The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above
- Record
CVE-2022-25327- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-255, CWE-276
- Updated
- 2026-11-02
OSV
Local Denial of Service in fscrypt PAM module
The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above
- Record
CVE-2022-25327- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-255
- Updated
- 2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2022-25327
The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above
- Record
DEBIAN-CVE-2022-25327- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVGHSA-8vwm-8vj8-rqjf
User login denial of service in github.com/google/fscrypt
The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above
- Record
GHSA-8vwm-8vj8-rqjf- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-276
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-25327
The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above
- Record
UBUNTU-CVE-2022-25327- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-p93v-m2r2-4387 No score
Denial of service via insufficient metadata validation
The PAM module for fscrypt through v0.3.2 doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to v0.3.3 or above.
For more details, see CVE-2022-25327.
- Record
GHSA-p93v-m2r2-4387- Updated
- 2026-11-02
OSVGO-2022-0340 No score
User login denial of service in github.com/google/fscrypt
User login denial of service in github.com/google/fscrypt
- Record
GO-2022-0340- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11902-1 No score
fscrypt-0.3.3-1.1 on GA media
These are all security issues fixed in the fscrypt-0.3.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11902-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/google/fscryptGo |
before 0.3.3 | 0.3.3 |
fscryptDebian:12 |
before 0.3.3-1 | 0.3.3-1 |
fscryptDebian:13 |
before 0.3.3-1 | 0.3.3-1 |
fscryptDebian:14 |
before 0.3.3-1 | 0.3.3-1 |
fscryptUbuntu:18.04:LTS |
All versions, plus listed versions 0.2.2-0ubuntu20.2.2-0ubuntu2.1 |
None known |
fscryptUbuntu:20.04:LTS |
All versions, plus listed versions 0.2.4-20.2.5-10.2.5-2 |
None known |
fscryptopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 0.3.3-1.1 | 0.3.3-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-25327 is a medium vulnerability (CVSS 5.5) in Google Fscrypt, published February 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in github.com/google/fscrypt 0.3.3.
References
github.com/google/fscrypt/pull/346
nvd.nist.gov/vuln/detail/CVE-2022-25327
pkg.go.dev/vuln/GO-2022-0340
Show 13 moreShow less
security-tracker.debian.org/tracker/CVE-2022-25327
ubuntu.com/security/CVE-2022-25327
openwall.com/lists/oss-security/2022/02/24/1
cve.org/CVERecord?id=CVE-2022-25327
suse.com/security/cve/CVE-2022-25326