884801 – (CVE-2022-23467) <sys-apps/openrazer-3.5.1: OOB read (potential KASLR bypass)

Bug 884801 (CVE-2022-23467) - <sys-apps/openrazer-3.5.1: OOB read (potential KASLR bypass)

Summary: <sys-apps/openrazer-3.5.1: OOB read (potential KASLR bypass)

Status:	RESOLVED FIXED

Alias:	CVE-2022-23467

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal trivial (vote)
Assignee:	Gentoo Security

URL:	https://github.com/openrazer/openraze...
Whiteboard:	~4 [noglsa]
Keywords:

Depends on:
Blocks:

Reported:	2022-12-08 01:58 UTC by John Helmert III
Modified:	2022-12-08 03:02 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2022-12-08 01:58:06 UTC

CVE-2022-23467:

OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. Using a modified USB device an attacker can leak stack addresses of the `razer_attr_read_dpi_stages`, potentially bypassing KASLR. To exploit this vulnerability an attacker would need to access to a users keyboard or mouse or would need to convince a user to use a modified device. The issue has been patched in v3.5.1. Users are advised to upgrade and should be reminded not to plug in unknown USB devices.

Please cleanup.

Comment 1 Larry the Git Cow gentoo-dev

2022-12-08 02:50:14 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=37844ccfa07b3fd7b083c23241679a51e03ba143

commit 37844ccfa07b3fd7b083c23241679a51e03ba143
Author:     Maciej Barć <xgqt@gentoo.org>
AuthorDate: 2022-12-08 02:49:35 +0000
Commit:     Maciej Barć <xgqt@gentoo.org>
CommitDate: 2022-12-08 02:50:11 +0000

    sys-apps/openrazer: drop old vulnerable versions
    
    Bug: https://bugs.gentoo.org/884801
    Signed-off-by: Maciej Barć <xgqt@gentoo.org>

 sys-apps/openrazer/Manifest                  |   2 -
 sys-apps/openrazer/openrazer-3.4.0-r3.ebuild | 160 ---------------------------
 sys-apps/openrazer/openrazer-3.5.0.ebuild    | 160 ---------------------------
 3 files changed, 322 deletions(-)

Comment 2 John Helmert III archtester

2022-12-08 03:02:42 UTC

Thanks, all done!