CVE-2022-40297: ubports ubuntu_touch Improper Privilege Management

Vulnerability summary

CVE-2022-40297 is a high (CVSS 7.8) Improper Privilege Management vulnerability in ubports ubuntu_touch. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 08-09-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode is only four digits, far below typical length/complexity for a user account's password. NOTE: a third party states "The described attack cannot be executed as demonstrated.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.