5.5Medium

CVE-2022-1804Accountsservice incorrectly drops privileges

Ubuntu Linux Published: 2025-03-25 15:28 (1 year ago)

Description

accountsservice no longer drops permissions when writting .pam_environment

Weakness (CWE): CWE-269

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
canonical	accountsservice	< 22.07.5-2ubuntu1.3
canonical	ubuntu linux	22.04
Ubuntu	Linux	0.6.55-3ubuntu1 – < 22.07.5-2ubuntu1.3

References and patches

https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/1974250 issue-trackingIssue Tracking
https://ubuntu.com/security/notices/USN-5439-1 release-notesVendor Advisory

CPE matches (NVD) (2)

cpe:2.3:a:canonical:accountsservice:*:*:*:*:*:*:*:* < 22.07.5-2ubuntu1.3
cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*

CVSS score

5.5Medium

Source: canonical · CVSS 3.1

Attack vector: Local
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

All scores (2)

cna	CVSS 3.1	5.5Medium
security@ubuntu.com	CVSS 3.1	5.5Medium

EPSS (chance of exploitation in 30 days)

0.14%

higher than 3% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2022-05-19
Published2025-03-25 15:28
Reached IP-DB2026-10-24 23:37
Last updated2026-06-17 07:23

Assigned by (CNA): canonical
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Ubuntu 22.04 LTS

7.7High

CVE-2026-109518 7 days ago

APT RCE via hard link reuse

Debian APT; Ubuntu APT

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…

7.8High

CVE-2026-114148 13 days ago

ASP.NET Core Elevation of Privilege Vulnerability

Microsoft .NET 10.0 installed on Linux; Microsoft .NET 10.0 installed on Mac OS; Microsoft .NET 10.0 installed on Windows; Microsoft .NET 11.0 installed on Linux

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Unscored

CVE-2026-98912 19 days ago

ALSA: seq: oss: Reject reads that cannot fit the next event

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it f…

7.5High

CVE-2026-98911 19 days ago

dpaa2-switch: fix the error path in dpaa2_switch_rx()

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd() function is called in order to free the FD. This is incorrect sinc…

Unscored

CVE-2026-98909 19 days ago

net: cpsw_new: unregister devlink on port registration failure

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: unregister devlink on port registration failure cpsw_probe() registers devlink before registering the CPSW ports. If cpsw_register_ports() fails, the error path only unregis…

Unscored

CVE-2026-98907 19 days ago

btrfs: protect sb_write_pointer() with invalidate lock

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb_write_pointer() with invalidate lock sb_write_pointer() reads the super block from the block device page cache using read_cache_page_gfp(). This has the same race with BLK…