CVE-2022-23220

USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.52% chance of exploitation in the next 30 days, 42th percentile

Published

2022-01-21

Updated

2024-08-03

Proof-of-concept exploits (1)

• http://www.openwall.com/lists/oss-security/2022/01/22/1

References

• CVE Record
• NVD entry

Related

• CVE-2022-2321
• CVE-2022-23221
• CVE-2022-23180
• CVE-2022-23222
• CVE-2022-23179
• CVE-2022-23227