Google fscrypt denial of service via insufficient metadata validation in PAM module

Executive brief

A vulnerability in the fscrypt PAM module, a tool used for managing Linux filesystem encryption, allows a local user to block other users from logging into the system. By creating a specially crafted metadata file, an attacker can trigger a denial-of-service condition that disrupts normal system access. This could prevent employees or administrators from accessing their accounts and performing their duties.

Technical details

The fscrypt PAM module through version 0.3.2 contains a denial-of-service vulnerability due to insufficient validation of fscrypt metadata files. A local, authenticated attacker can exploit this by creating a malformed or malicious metadata file that the PAM module fails to process correctly during the authentication flow. This failure prevents other users from successfully completing the login process. The issue is addressed in version 0.3.3 by implementing stricter metadata validation.

Affected products

• Google fscrypt <= 0.3.2

Timeline

• 2022-02-26: disclosed: Vulnerability disclosed and patched in source repository.
• 2022-03-01: advisory: GitHub Advisory published.

References

• https://api.github.com/users/mgerstner
• https://github.com/mgerstner
• https://api.github.com/users/mgerstner/gists%7B/gist_id%7D
• https://api.github.com/users/mgerstner/repos
• https://avatars.githubusercontent.com/u/24227799?v=4
• https://api.github.com/users/mgerstner/events%7B/privacy%7D