CVE-2022-0555 Information disclosure in subiquity
The Ubuntu installer displays storage passphrases in plaintext with world-readable permissions, allowing local attackers to steal sensitive credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-0555?
CVE-2022-0555 is a high-severity vulnerability in Canonical Ltd. subiquity, published on 3 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions
Weakness: CWE-256
Which versions are affected by CVE-2022-0555?
It affects 1 product.
Products include Canonical Subiquity.
How do I fix CVE-2022-0555?
No fix has been published for CVE-2022-0555 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-0555 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-0555 exists.
Other vulnerabilities in Canonical Ltd. subiquity
Sources
Also known as GHSA-fghj-2j25-cqqp, UBUNTU-CVE-2022-0555.