CVE-2022-3048: Inappropriate implementation in Chrome OS lockscreen
Inappropriate implementation in Chrome OS lockscreen in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a local attacker to bypass lockscreen navigation restrictions via physical access to the device.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 105.0.5195.52 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 105.0.5195.52-1 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 105.0.5195.52
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-3048.
What is the description of CVE-2022-3048?
CVE-2022-3048 is an inappropriate implementation in the Chrome OS lockscreen in Google Chrome on Chrome OS prior to 105.0.5195.52, which allowed a local attacker to bypass lockscreen navigation restrictions via physical access to the device.
What software is affected by CVE-2022-3048?
Google Chrome on Chrome OS versions prior to 105.0.5195.52 is affected by CVE-2022-3048.
What is the severity rating of CVE-2022-3048?
CVE-2022-3048 has a severity rating of medium.
How can I fix CVE-2022-3048?
To fix CVE-2022-3048, update Google Chrome on Chrome OS to version 105.0.5195.52 or later.