DSA-5052: -1 usbview -- security update

Published Jan 21, 2022

Updated

Matthias Gerstner reported that usbview, a USB device viewer, does not properly handle authorization in the PolicyKit policy configuration, which could result in root privilege escalation.

Affected Software

2 affected components

debian/usbview

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch DSA-5052-1

Event History

Jan 21, 2022

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2022-23220

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The issue could allow root privilege escalation, so exploitation would be relevant to an attacker who can interact with the affected system and trigger the improperly authorized PolicyKit action.

Which component should be checked during triage?

Check systems that have Debian's usbview package installed, particularly its PolicyKit policy configuration. The reported flaw is in how usbview handles authorization through that configuration.

DSA-5052: -1 usbview -- security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which component should be checked during triage?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which component should be checked during triage?