A vulnerability has been discovered in usbview where certain users can trigger a privilege escalation.

Announced

2023-10-26

Revised

2023-10-26

Access

local

Bugs

#831756

Advisory

https://security.gentoo.org/glsa/202310-15

Affected packages

Package	Arch	Vulnerable	Unaffected
app-admin/usbview	*	< 2.2	>= 2.2

Background

USBView is a tool to display the topology of devices on the USB bus.

Description

A vulnerability has been discovered in usbview. Please review the CVE identifier referenced below for details.

Impact

USBView allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option.

Workaround

There is no known workaround at this time.

Resolution

All USBView users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-admin/usbview-2.2"

References

• CVE-2022-23220