Read the docs
TI-2014-01100 Aliases CVE-2014-1422GHSA-hm2r-m89c-6rgm

Location service uses cached authorization even after revocation

Priority LOW 23CWE-275Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. This is because the cache was not ordered by creation time by the Select struct in src/core/trust/impl/sqlite3/store.cpp. Fixed in trust-store (Ubuntu) version 1.1.0+15.04.20150123-0ubuntu1 and trust-store (Ubuntu RTM) version 1.1.0+15.04.20150123~rtm-0ubuntu1.

Why it matters now

EPSS 0.00371 31st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed trust-store (Ubuntu) (Canonical): 1.1.0+15.04.20150123-0ubuntu1trust-store (Ubuntu RTM) (Canonical): 1.1.0+15.04.20150123~rtm-0ubuntu1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canonicaltrust-store (Ubuntu)1.1.0 to before 1.1.0+15.04.20150123-0ubuntu11.1.0+15.04.20150123-0ubuntu1Patch availableCNA
Canonicaltrust-store (Ubuntu RTM)1.1.0 to before 1.1.0+15.04.20150123~rtm-0ubuntu11.1.0+15.04.20150123~rtm-0ubuntu1Patch availableCNA
  • trust-store (Ubuntu) VendorCanonical Affected 1.1.0 to before 1.1.0+15.04.20150123-0ubuntu1 Fixed in 1.1.0+15.04.20150123-0ubuntu1 Patch available CNA
  • trust-store (Ubuntu RTM) VendorCanonical Affected 1.1.0 to before 1.1.0+15.04.20150123~rtm-0ubuntu1 Fixed in 1.1.0+15.04.20150123~rtm-0ubuntu1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:canonical:trust-store_\(ubuntu\):*:*:*:*:*:*:*:*before 1.1.0VulnerableCanonical
cpe:2.3:a:canonical:trust-store_\(ubuntu_rtm\):*:*:*:*:*:*:*:*before 1.1.0VulnerableCanonical
  • cpe:2.3:a:canonical:trust-store_\(ubuntu\):*:*:*:*:*:*:*:* Versions before 1.1.0 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:trust-store_\(ubuntu_rtm\):*:*:*:*:*:*:*:* Versions before 1.1.0 Vulnerable ·Canonical

Remediation

  • Fix · CNA trust-store (Ubuntu) (Canonical) Fixed in 1.1.0+15.04.20150123-0ubuntu1
  • Fix · CNA trust-store (Ubuntu RTM) (Canonical) Fixed in 1.1.0+15.04.20150123~rtm-0ubuntu1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-1422
  2. 2026-10-03 Alias added: GHSA-hm2r-m89c-6rgm

References

Exploit 1

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences