CVE-2022-23220

    Dashboard / Vulnerabilities / CVE-2022-23220

    CVE-2022-23220

    Published: 21 Jan 2022Last Modified: 21 Oct 2026

    Summary:

    Details: USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.

    References: https://www.openwall.com/lists/oss-security/2022/01/21/1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23220.json, https://nvd.nist.gov/vuln/detail/CVE-2022-23220, https://security.gentoo.org/glsa/202310-15, https://www.debian.org/security/2022/dsa-5052, https://github.com/gregkh/usbview/commit/bf374fa4e5b9a756789dfd88efa93806a395463b, http://www.openwall.com/lists/oss-security/2022/01/22/1

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- e4a0a804b388058b844c8d1e06c24b1254c49a71
    Fixed -38e9dc56a437721f7a8b0ec1d2b4e611e090c87d

    Affected versions

    v2.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-23220 | CVE-DB