Bug 831756 – <app-admin/usbview-2.2: root privilege escalation via insecure polkit settings

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2022-01-21 18:37:23 UTC]

CVE-2022-23220 (https://github.com/gregkh/usbview/commit/bf374fa4e5b9a756789dfd88efa93806a395463b):

USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.

Please bump to 2.2.

[Comment 1 Larry the Git Cow 2022-01-21 23:58:53 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=09ea588269f415e8a298e7354b6fd2ee0b81e443

commit 09ea588269f415e8a298e7354b6fd2ee0b81e443
Author:     James Beddek <[e-mail]>
AuthorDate: 2022-01-21 23:26:55 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2022-01-21 23:58:38 +0000

    app-admin/usbview: add 2.2
    
    Bug: https://bugs.gentoo.org/831756
    Signed-off-by: James Beddek <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/23905
    Signed-off-by: Sam James <[e-mail]>

 app-admin/usbview/Manifest           |  1 +
 app-admin/usbview/usbview-2.2.ebuild | 30 ++++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)

[Comment 2 John Helmert III 2022-01-22 04:25:43 UTC]

Thank you for handling so quickly!

[Comment 3 John Helmert III 2022-01-28 23:22:23 UTC]

Please cleanup

[Comment 4 Larry the Git Cow 2022-01-29 06:20:16 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=60d3009bc5cae452e85b821b14116bfda4328b93

commit 60d3009bc5cae452e85b821b14116bfda4328b93
Author:     James Beddek <[e-mail]>
AuthorDate: 2022-01-28 23:24:16 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2022-01-29 06:18:22 +0000

    app-admin/usbview: drop 2.0, 2.1
    
    Bug: https://bugs.gentoo.org/831756
    Signed-off-by: James Beddek <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/24004
    Signed-off-by: Sam James <[e-mail]>

 app-admin/usbview/Manifest           |  2 --
 app-admin/usbview/usbview-2.0.ebuild | 35 -----------------------------------
 app-admin/usbview/usbview-2.1.ebuild | 30 ------------------------------
 3 files changed, 67 deletions(-)

[Comment 5 John Helmert III 2022-01-29 18:04:19 UTC]

Thanks!

[Comment 6 Larry the Git Cow 2023-10-26 04:42:24 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=9b37029def1302232522409885fc2b1bd992ba85

commit 9b37029def1302232522409885fc2b1bd992ba85
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2023-10-26 04:41:42 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2023-10-26 04:42:17 +0000

    [ GLSA 202310-15 ] USBView: root privilege escalation via insecure polkit settings
    
    Bug: https://bugs.gentoo.org/831756
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202310-15.xml | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)