Medium severity · published Aug 23, 2018
CVE-2018-6558
The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to…
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam).
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FS
Fscrypt · Google
before 0.2.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-6558
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-6558
Patch
https://github.com/google/fscrypt/commit/3022c1603d968c22f147b4a2c49c4637dd1be91b
Patch
https://github.com/google/fscrypt/commit/315f9b042237200174a1fb99427f74027e191d66
Issue Tracking
https://github.com/google/fscrypt/issues/77
Issue Tracking
https://launchpad.net/bugs/1787548
More from Fscrypt
7.3
CVE-2022-25328
The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances
5.5
CVE-2022-25327
The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in
5.5
CVE-2022-25326
fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space