PT-2022-4899 · Unknown · Enlightenment

Maherazzouzi · Published 2022-09-14 · Updated 2024-12-01 · CVE-2022-37706

Positive Technologies · (AI Summary)

CVSS v3.1

7.8

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

Enlightenment versions prior to 0.25.4

Description:

The issue is related to the Enlightenment window manager's system file, specifically with the `enlightenment sys` component. It is setuid root and mishandles pathnames that begin with a `/dev/..` substring, allowing local users to gain privileges. This can lead to privilege escalation, potentially giving an attacker root privileges. The exploit has been tested on Ubuntu 22.04 but is expected to work on other distributions as well.

Recommendations:

For versions prior to 0.25.4, update to version 0.25.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `enlightenment sys` component until a patch is available. Avoid using pathnames that begin with a `/dev/..` substring in the affected system library function.

Exploit

Fix

Code Injection

Improper Privilege Management

OS Command Injection

Weakness Enumeration

CWE-94

CWE-269

CWE-78

Related Identifiers

BDU:2022-06060

CVE-2022-37706

DLA-3115-1

DSA-5233-1

MGASA-2022-0360

OPENSUSE-SU-2022:10153-1

OPENSUSE-SU-2024:12365-1

Affected Products

Enlightenment

References · 45

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/ubuntu_enlightenment_mount_priv_esc.rb · Exploit
• 🔥 https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit · Exploit
• 🔥 https://exploit-db.com/exploits/51180 · Exploit
• https://bdu.fstec.ru/vul/2022-06060 · Security Note
• https://security-tracker.debian.org/tracker/DSA-5233-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37706 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37706 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3115-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0360 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-37706 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0360.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2022:10153-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-37706 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5233-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-3115-1 · Vendor Advisory