PT-2022-25471 · Kdiskmark+1 · Kdiskmark+1

Matthias Gerstner · Published 2022-09-14 · Updated 2023-03-23 · CVE-2022-40673

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KDiskMark versions prior to 3.1.0

Description The issue is related to a lack of authorization checking for D-Bus methods, specifically methods such as Helper::flushPageCache(). This lack of authorization could potentially allow unauthorized access or actions.

Recommendations For versions prior to 3.1.0, update to version 3.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the D-Bus methods, such as Helper::flushPageCache(), until a patch is available.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

ALT-PU-2022-3362

ALT-PU-2023-1502

CVE-2022-40673

Affected Products

Alt Linux

Kdiskmark

References · 8

• 🔥 http://openwall.com/lists/oss-security/2022/09/14/1 · Exploit
• https://github.com/JonMagon/KDiskMark/commit/3c90083a4f5ba3f240a797e509d818221542bbdc · Patch
• https://osv.dev/vulnerability/CVE-2022-40673 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40673 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YYO3GWTNPHNCLHSI562Q3KX43PW7FQ4Q · Vendor Advisory
• https://github.com/JonMagon/KDiskMark/compare/3.0.0...3.1.0 · Note
• https://github.com/JonMagon/KDiskMark/releases/tag/3.1.0 · Note
• https://t.me/cibsecurity/49768 · Telegram Post