Ubuntu.comUB:CVE-2022-23467CVE-2022-23467
4.6 Medium
CVSS3
Attack Vector
PHYSICAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
25.5%
OpenRazer is an open source driver and user-space daemon to control Razer
device lighting and other features on GNU/Linux. Using a modified USB
device an attacker can leak stack addresses of the
razer_attr_read_dpi_stages, potentially bypassing KASLR. To exploit this
vulnerability an attacker would need to access to a users keyboard or mouse
or would need to convince a user to use a modified device. The issue has
been patched in v3.5.1. Users are advised to upgrade and should be reminded
not to plug in unknown USB devices.
References
github.com/openrazer/openrazer/commit/33aa7f07d54ae066f201c6d298cb4a2181cb90e6
github.com/openrazer/openrazer/security/advisories/GHSA-39hg-jvc9-fg7h
launchpad.net/bugs/cve/CVE-2022-23467
nvd.nist.gov/vuln/detail/CVE-2022-23467
security-tracker.debian.org/tracker/CVE-2022-23467
www.cve.org/CVERecord?id=CVE-2022-23467
Related
4.6 Medium
CVSS3
Attack Vector
PHYSICAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
25.5%