Privilege Escalation in UBports Ubuntu Touch by User Passcode
CVE-2022-40297
Key Information:
- Vendor
Ubports
- Status
- Vendor
- CVE Published:
- 9 September 2022
Badges
What is CVE-2022-40297?
A security flaw in UBports Ubuntu Touch 16.04 enables the screen-unlock passcode to grant access to a privileged shell through Sudo. The vulnerability arises from the use of a simple four-digit passcode, which significantly compromises security compared to standard user account password complexities. This weakness could potentially allow unauthorized users to execute commands with elevated privileges, posing a risk to the integrity of the system. It is important to note that there are claims indicating the described exploit may not be feasible as demonstrated.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.