CVE-2018-6558

EUVD-2021-1381
The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 34%
Affected Products (NVD)
VendorProductVersion
googlefscrypt
𝑥
< 0.2.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
fscrypt
bookworm
0.3.3-1
fixed
bullseye
0.2.9-1
fixed
sid
0.3.5-1
fixed
trixie
0.3.5-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
fscrypt
bionic
Fixed 0.2.2-0ubuntu2.1
released
cosmic
ignored
disco
not-affected
trusty
dne
xenial
dne
References
https://github.com/google/fscrypt/commit/3022c1603d968c22f147b4a2c49c4637dd1be91b
https://github.com/google/fscrypt/commit/315f9b042237200174a1fb99427f74027e191d66
https://github.com/google/fscrypt/issues/77
https://launchpad.net/bugs/1787548
https://github.com/google/fscrypt/commit/3022c1603d968c22f147b4a2c49c4637dd1be91b
https://github.com/google/fscrypt/commit/315f9b042237200174a1fb99427f74027e191d66
https://github.com/google/fscrypt/issues/77
https://launchpad.net/bugs/1787548