Code Injection in USBView - CVE-2022-23220

Vulnerability identifier: #VU59950

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-23220

CWE-ID: CWE-94

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to improper authentication validation by certain Polkit settings for pkexec. A local user can send a specially crafted request using the --gtk-module option and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

USBView
Gentoo Linux
Ubuntu
Fedora
usbview (Debian package)
usbview (Ubuntu package)
app-admin/usbview
usbview

Install updates from vendor's website.

USBView - update to 2.2
usbview (Debian package) - addressed in versions 2.0-21-g6fe2f4f-2+deb10u1, 2.0-21-g6fe2f4f-2+deb11u1
usbview (Ubuntu package) - addressed in versions 2.0-21-g6fe2f4f-2ubuntu0.20.04.1, 2.0-21-g6fe2f4f-2ubuntu0.21.10.3, 2.0-21-g6fe2f4f-1ubuntu1.1
app-admin/usbview - update to 2.2
usbview - addressed in versions 3.0-1.fc34, 3.0-1.fc35

• https://github.com/gregkh/usbview/commit/bf374fa4e5b9a756789dfd88efa93806a395463b
• https://www.openwall.com/lists/oss-security/2022/01/21/1
• https://www.debian.org/security/2022/dsa-5052
• http://www.openwall.com/lists/oss-security/2022/01/22/1

• Code execution in USBView
• Debian update for usbview
• Ubuntu update for usbview
• Gentoo update for USBView
• Fedora 35 update for usbview
• Fedora 34 update for usbview