PT-2022-15906 · Canonical+1 · Ubuntu+1

Matthias Gerstner · Published 2022-01-21 · Updated 2024-06-15 · CVE-2022-23220

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions USBView versions 2.1 through 2.1

Description The issue allows local users, such as those logged in via SSH, to execute arbitrary code as root due to certain Polkit settings, like allow any=yes, disabling the authentication requirement for pkexec. This can be exploited, for example, using the --gtk-module option. The affected operating systems include Ubuntu, Debian, and Gentoo.

Recommendations For USBView version 2.1, update to version 2.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of pkexec with vulnerable Polkit settings to minimize the risk of exploitation.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-23220

DSA-5052-1

OPENSUSE-SU-2024:11774-1

USN-5249-1

Affected Products

Linuxmint

Ubuntu

References · 18

• 🔥 https://openwall.com/lists/oss-security/2022/01/21/1 · Exploit
• https://github.com/gregkh/usbview/commit/bf374fa4e5b9a756789dfd88efa93806a395463b · Patch
• https://security.gentoo.org/glsa/202310-15 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23220 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23220 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-23220 · Security Note
• https://osv.dev/vulnerability/USN-5249-1 · Vendor Advisory
• https://debian.org/security/2022/dsa-5052 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-23220 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5052-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11774-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23220 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5249-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-23220 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23220 · Vendor Advisory