Privilege escalation through command injection in fscrypt

The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escalate their privileges if they create a malicious mountpoint path and if the system administrator happens to be using the fscrypt bash completion script to complete mountpoint paths. We recommend upgrading to version 0.3.3 or above

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Google Fscrypt 操作系统操作系统命令注入漏洞

Google Fscrypt是美国谷歌（Google）公司的一个开源高级工具。用于管理 Linux 本机文件系统加密。 fscrypt存在操作系统命令注入漏洞，该漏洞的存在是由于fscrypt bash完成脚本中不正确的输入验证。未经身份验证的远程攻击者可利用该漏洞可以将专门制作的数据传递给应用程序，并在目标系统上执行任意命令。该漏洞允许远程攻击者可利用该漏洞在目标系统上执行任意命令。

N/A

N/A