PT-2022-16009 · Openrazer+1 · Openrazer+1

Kwstubbs + 1 · Published 2022-12-05 · Updated 2025-04-24 · CVE-2022-23467

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenRazer versions prior to 3.5.1

Description OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. Using a modified USB device, an attacker can leak stack addresses of the razer attr read dpi stages, potentially bypassing KASLR. To exploit this issue, an attacker would need to access a user's keyboard or mouse or convince a user to use a modified device.

Recommendations For versions prior to 3.5.1, upgrade to version 3.5.1 or later to resolve the issue. As a general precaution, users should be reminded not to plug in unknown USB devices.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2022-23467

DLA-4136-1

GHSA-39HG-JVC9-FG7H

Affected Products

Debian

Openrazer

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23467.json · Exploit
• https://github.com/openrazer/openrazer/security/advisories/GHSA-39hg-jvc9-fg7h · Patch
• https://github.com/openrazer/openrazer/commit/33aa7f07d54ae066f201c6d298cb4a2181cb90e6 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-23467 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-23467 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23467 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23467 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-23467 · Security Note
• https://osv.dev/vulnerability/DLA-4136-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23467 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23467 · Vendor Advisory
• https://t.me/cvenotify/39170 · Telegram Post
• https://lists.debian.org/debian-lts-announce/2025/04/msg00032.html · Note
• https://t.me/cibsecurity/54019 · Telegram Post