PT-2022-4899 · Unknown+1 · Enlightenment+1

Maherazzouzi · Published 2022-09-14 · Updated 2024-12-01 · CVE-2022-37706

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Enlightenment versions prior to 0.25.4

Description The issue is related to the Enlightenment window manager's system file, specifically with the enlightenment sys component. It is setuid root and mishandles pathnames that begin with a /dev/.. substring, allowing local users to gain privileges. This can lead to privilege escalation, potentially giving an attacker root privileges. The exploit has been tested on Ubuntu 22.04 but is expected to work on other distributions as well.

Recommendations For versions prior to 0.25.4, update to version 0.25.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the enlightenment sys component until a patch is available. Avoid using pathnames that begin with a /dev/.. substring in the affected system library function.

Exploit

Fix

Improper Privilege Management

Code Injection

OS Command Injection

Weakness Enumeration

CWE-269

CWE-94

CWE-78

Related Identifiers

ALT-PU-2022-2642

BDU:2022-06060

CVE-2022-37706

DLA-3115-1

DSA-5233-1

MGASA-2022-0360

OPENSUSE-SU-2022:10153-1

OPENSUSE-SU-2024:12365-1

Affected Products

Alt Linux

Enlightenment

References · 42

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/ubuntu_enlightenment_mount_priv_esc.rb · Exploit
• 🔥 https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit · Exploit
• 🔥 https://exploit-db.com/exploits/51180 · Exploit
• https://advisories.mageia.org/MGASA-2022-0360.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-37706 · Vendor Advisory
• https://git.enlightenment.org/enlightenment/enlightenment/commit/cc7faeccf77fef8b0ae70e312a21e4cde087e141 · Patch
• https://cve.org/CVERecord?id=CVE-2022-37706 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-37706 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-37706 · Vendor Advisory
• https://git.enlightenment.org/enlightenment/enlightenment/commit/cae78cbb169f237862faef123e4abaf63a1f5064 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-37706 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-37706 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06060 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2022:10153-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5233-1 · Vendor Advisory