{"id":"CVE-2018-6558","aliases":["DEBIAN-CVE-2018-6558","EUVD-2021-1381","GHSA-qj26-7grj-whg3","GO-2020-0027","UBUNTU-CVE-2018-6558"],"status":"published","title":"Privilege Escalation in fscrypt","description":"The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam).","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00624,"percentile":0.50156,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2018-08-23T17:00:00Z","modified":"2026-10-23T18:03:23Z","fixes":[{"ecosystem":"Go","package":"github.com/google/fscrypt","fixed_in":["0.2.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"fscrypt","fixed_in":["0.2.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"fscrypt","fixed_in":["0.2.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"fscrypt","fixed_in":["0.2.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"fscrypt","fixed_in":["0.2.2-0ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/google/fscrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"fscrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"fscrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"fscrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.4-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/google/fscrypt","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/google/fscrypt","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"fscrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.2-0ubuntu2.1"}]}],"versions":["0.2.2-0ubuntu2"]}],"products":[{"vendor":"google","product":"fscrypt"},{"vendor":"google llc","product":"fscrypt"},{"vendor":"the fscrypt project","product":"fscrypt"}],"references":[{"url":"https://github.com/google/fscrypt/issues/77","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/google/fscrypt/commit/3022c1603d968c22f147b4a2c49c4637dd1be91b","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/google/fscrypt/commit/315f9b042237200174a1fb99427f74027e191d66","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://launchpad.net/bugs/1787548","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6558","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2020-0027","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qj26-7grj-whg3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-6558","tags":["advisory"]},{"url":"https://github.com/google/fscrypt","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2018-6558","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-6558","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-6558","description":"The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam).","status":"published","published":"2018-08-23T20:00:00Z","modified":"2024-09-17T02:06:50.219Z","updated_at":"2026-11-02T14:35:05.961936Z"}],"euvd":[{"id":"EUVD-2021-1381","description":"The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam).","status":"published","published":"2018-08-23T20:00:00Z","modified":"2024-09-17T02:06:50Z","updated_at":"2026-11-03T00:28:43.354671Z"}],"ghsa":[{"id":"GHSA-qj26-7grj-whg3","title":"Privilege Escalation in fscrypt","description":"The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam).","status":"published","published":"2021-06-23T17:18:49Z","modified":"2024-05-20T19:39:12Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T14:37:50.750599Z"}],"nvd":[{"id":"CVE-2018-6558","description":"The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam).","status":"published","published":"2018-08-23T19:29:01.127Z","modified":"2026-06-17T02:02:01.473Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.9,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:36.842579Z"}],"osv":[{"id":"CVE-2018-6558","description":"The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam).","status":"published","published":"2018-08-23T19:29:01.127Z","modified":"2026-10-20T10:50:29.429755717Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"DEBIAN-CVE-2018-6558","description":"The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam).","status":"published","published":"2018-08-23T19:29:01.127Z","modified":"2026-10-23T18:03:23.663262506Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"GHSA-qj26-7grj-whg3","title":"Privilege Escalation in fscrypt","description":"The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam).","status":"published","published":"2021-06-23T17:18:49Z","modified":"2024-05-20T19:39:08Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"UBUNTU-CVE-2018-6558","description":"The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam).","status":"published","published":"2018-08-23T17:00:00Z","modified":"2025-07-16T07:38:57.759635Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"GO-2020-0027","title":"Privilege escalation in github.com/google/fscrypt","description":"After dropping and then elevating process privileges euid, guid, and groups are not properly restored to their original values, allowing an unprivileged user to gain membership in the root group.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}