CVE-2022-23220: High severity Usbview Project Usbview vulnerability
USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allowany=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/usbviewto a version that resolves this vulnerability.Fixed in 3.0-3Fixed in 3.1-2Fixed in 3.1-3Fixed in 3.1+git20250817.a3de218-1 - Upgrade
Upgrade
debian/usbviewto a version that resolves this vulnerability.Fixed in 2.0-21-g6fe2f4f-2.1 - Upgrade
Upgrade
USBViewto a version that resolves this vulnerability.Fixed in 2.2
Event History
Frequently Asked Questions
What is the vulnerability ID for USBView?
The vulnerability ID for USBView is CVE-2022-23220.
What is the severity of CVE-2022-23220?
The severity of CVE-2022-23220 is high with a CVSS score of 7.8.
Which software versions of USBView are affected by CVE-2022-23220?
USBView versions before 2.2 are affected by CVE-2022-23220.
How can local users exploit CVE-2022-23220?
Some local users (e.g., ones logged in via SSH) can exploit CVE-2022-23220 to execute arbitrary code as root.
Are Ubuntu, Debian, and Gentoo Linux vulnerable to CVE-2022-23220?
No, Ubuntu, Debian, and Gentoo Linux are not vulnerable to CVE-2022-23220.