---

Gentoo Linux Security Advisory GLSA 202310-15

---

                                       https://security.gentoo.org/  

---

Severity: High
Title: USBView: root privilege escalation via insecure polkit settings
Date: October 26, 2023
Bugs: #831756
ID: 202310-15

---

Synopsis

A vulnerability has been discovered in usbview where certain users can
trigger a privilege escalation.

Background

USBView is a tool to display the topology of devices on the USB bus.

Affected packages

Package Vulnerable Unaffected

---

app-admin/usbview < 2.2 >= 2.2

Description

A vulnerability has been discovered in usbview. Please review the CVE
identifier referenced below for details.

Impact

USBView allows some local users (e.g., ones logged in via SSH) to
execute arbitrary code as root because certain Polkit settings (e.g.,
allow_any=yes) for pkexec disable the authentication requirement. Code
execution can, for example, use the --gtk-module option.

Workaround

There is no known workaround at this time.

Resolution

All USBView users should upgrade to the latest version:

emerge --sync

emerge --ask --oneshot --verbose “>=app-admin/usbview-2.2”

References

[ 1 ] CVE-2022-23220
https://nvd.nist.gov/vuln/detail/CVE-2022-23220

Availability

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/202310-15

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users’ machines is of utmost
importance to us. Any security concerns should be addressed to
[email protected] or alternatively, you may file a bug at
https://bugs.gentoo.org.

License

Copyright 2023 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5