CVE-2022-0555

What it actually does

The flaw exposes the guided storage passphrase in plaintext within configuration files or logs that are readable by any local user due to overly permissive file permissions.

Why it matters to the business

Attackers with local access can obtain encryption passphrases, potentially decrypting storage volumes and accessing sensitive data; low EPSS and absence from KEV indicate limited active exploitation risk despite the 868-day-old disclosure.

How an attack unfolds

An attacker with local shell access reads the subiquity guided storage configuration file or log containing the passphrase in cleartext; no named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Upgrade canonicalltd/subiquity to commit 4914e537ae869f6c088f078e54e4a1a34c691b17 or libheif to 1.17.6-1; restrict permissions on storage configuration files and rotate any exposed passphrases.

How to confirm the fix worked

Verify upgrade to the listed fixed versions, confirm passphrase-containing files have restrictive permissions (e.g., 600), and scan for any remaining plaintext passphrase artifacts in logs or configs.

Typical attack path

1. Obtain local user access on an affected Ubuntu Server system
2. Locate subiquity configuration or log files containing guided storage settings
3. Read the passphrase stored in plaintext
4. Use the passphrase to unlock encrypted storage volumes

How to detect it

Search installer logs, subiquity configuration directories, and system logs for plaintext passphrases; review file permissions on guided storage configs; no specific threat actor IOCs are known.

What your security team should do

• Prioritize patching subiquity and libheif to the exact fixed versions provided
• Audit local systems for plaintext passphrases in installer artifacts
• Enforce least-privilege file permissions on all storage configuration
• Monitor for any new EPSS increases given the stable low score