CVE-2014-1422: Location service uses cached authorization even after revocation
In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. This is because the cache was not ordered by creation time by the Select struct in src/core/trust/impl/sqlite3/store.cpp. Fixed in trust-store (Ubuntu) version 1.1.0+15.04.20150123-0ubuntu1 and trust-store (Ubuntu RTM) version 1.1.0+15.04.20150123~rtm-0ubuntu1.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1422?
CVE-2014-1422 is categorized as a medium severity vulnerability due to its impact on user privacy and location access.
How does CVE-2014-1422 affect application permissions?
CVE-2014-1422 allows applications to access cached location data even after permission is revoked by the user.
Which software is affected by CVE-2014-1422?
CVE-2014-1422 affects Canonical Trust-store in Ubuntu versions up to 1.1.0.
How do I fix CVE-2014-1422?
To fix CVE-2014-1422, upgrade the Canonical Trust-store to a version higher than 1.1.0.
What is the nature of the vulnerability in CVE-2014-1422?
CVE-2014-1422 stems from how the trust-store caches permissions, which does not prioritize revocation correctly.