CVE-2014-9687

What it actually does

Uses a hardcoded default salt when encrypting the mount passphrase, enabling efficient offline brute-force recovery of user passwords that protect encrypted volumes.

Why it matters to the business

Attackers can recover passphrases and decrypt user data stored on affected systems, resulting in exposure of sensitive files and potential regulatory or operational consequences.

How an attack unfolds

An attacker first obtains the encrypted passphrase file from disk or backup, recognizes the default salt value, and performs an offline dictionary or brute-force attack to recover the passphrase and decrypt the volume.

How to fix it

Upgrade ecryptfs-utils to a version that generates unique salts per volume; if no newer package is available, migrate to a maintained encryption solution that enforces per-volume salts.

How to confirm the fix worked

Inspect installed ecryptfs-utils version and review passphrase encryption configuration or generated salt values on sample volumes to confirm unique salts are in use.

Typical attack path

1. Locate the encrypted mount passphrase file on disk or in backups
2. Confirm presence of the known default salt value
3. Execute offline brute-force or dictionary attack against the passphrase
4. Use recovered passphrase to mount and access encrypted data

How to detect it

Search system package databases and logs for ecryptfs-utils versions 104 and earlier; examine .ecryptfs directories and passphrase files for the known default salt pattern.

What your security team should do

• Immediately inventory all systems using ecryptfs-utils version 104 or earlier
• Prioritize upgrade or replacement of affected packages
• Audit encrypted volumes for default-salt usage and re-encrypt where necessary
• Monitor for any public exploit code targeting this weakness