PT-2022-22080 · Google · Google Drive For Desktop

Published 2022-10-17 · Updated 2022-10-19 · CVE-2022-3421

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Drive for Desktop versions prior to 64.0

Description An attacker can pre-create the "/Applications/Google Drive.app/Contents/MacOS" directory, which is expected to be owned by root, to be owned by a non-root user. When the Drive for Desktop installer is run for the first time, it will place a binary in that directory with execute permissions and set its setuid bit. Since the attacker owns the directory, the attacker can replace the binary with a symlink, causing the installer to set the setuid bit on the symlink. When the symlink is executed, it will run with root permissions.

Recommendations For Google Drive for Desktop versions prior to 64.0, we recommend upgrading past version 64.0 to resolve the issue. As a temporary workaround, consider restricting access to the /Applications/Google Drive.app/Contents/MacOS directory to prevent exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

CWE-264

Related Identifiers

CVE-2022-3421

Affected Products

Google Drive For Desktop

References · 4

• https://support.google.com/a/answer/7577057?hl=en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3421 · Security Note
• https://t.me/cibsecurity/51632 · Telegram Post