Vulnerability identifier: #VU69702
Vulnerability risk: Low
CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-863
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
USBGuard
Universal components / Libraries /
Libraries used by multiple products
Vendor: USBGuard
Description
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to unspecified error within the usbguard-dbus daemon. A local user can allow all USB devices to be connected in the future.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
USBGuard: 0.1 - 1.0.0
External links
http://github.com/USBGuard/usbguard/pull/531
http://github.com/USBGuard/usbguard/issues/273
http://github.com/USBGuard/usbguard/issues/403
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B3HQVTHHJFQLSWSXA7W3ZHRF72YMPI46/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B2ET6DU4IA64M6TMQ4X3SG2L6TRPLDN6/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D4QO5J5YEWVX27QXYOGL3BDRV3KXNRQI/
http://lists.debian.org/debian-lts-announce/2022/04/msg00010.html
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.