CVE-2023-45592 Privilege escalation in imx6 bundle
Embedded Chromium runs with root privileges and no sandbox, allowing attackers to escalate privileges and execute code if the browser is compromised.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-45592?
CVE-2023-45592 is a medium-severity vulnerability in AiLux imx6 bundle, published on 5 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A CWE-250 “Execution with Unnecessary Privileges” vulnerability in the embedded Chromium browser (due to the binary being executed with the “--no-sandbox” option and with root privileges) exacerbates the impacts of successful attacks executed against the browser. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.
Weakness: CWE-250
Which versions are affected by CVE-2023-45592?
It affects 1 product.
Products include Ailux Imx6.
How do I fix CVE-2023-45592?
No fix has been published for CVE-2023-45592 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-45592 being exploited?
There is no known exploitation of CVE-2023-45592 in the wild and no public exploit code.
Other vulnerabilities in AiLux imx6 bundle
Sources
Also known as GHSA-j7fr-7wrw-rww2.