CVE-2022-29022
📋 TL;DR
A buffer overflow vulnerability in the razeraccessory driver of OpenRazer up to v3.3.0 allows attackers to cause a Denial of Service (DoS) and potentially escalate privileges by sending a crafted buffer to the matrix_custom_frame device. This affects systems using OpenRazer drivers for Razer peripherals on Linux.
💻 Affected Systems
- OpenRazer
📦 What is this software?
Openrazer by Openrazer Project
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to root, complete system compromise, and persistent access.
Likely Case
Local Denial of Service (kernel panic/crash) and potential privilege escalation if exploited by a local attacker.
If Mitigated
No impact if driver is not loaded or system is patched.
🎯 Exploit Status
Exploitation requires local access to the device file. Proof-of-concept code is available in public references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.3.1 and later
Vendor Advisory: https://github.com/openrazer/openrazer/pull/1790
Restart Required: Yes
Instructions:
1. Update OpenRazer to v3.3.1 or later. 2. Rebuild and reload the kernel module. 3. Reboot the system.
🔧 Temporary Workarounds
Remove device file permissions
linuxRemove write permissions from the vulnerable device file to prevent exploitation.
sudo chmod a-w /sys/class/razer/matrix_custom_frame
Unload OpenRazer driver
linuxTemporarily unload the vulnerable driver module.
sudo rmmod razeraccessory
🧯 If You Can't Patch
- Restrict access to the device file to root only.
- Disable or remove OpenRazer driver if not needed.
🔍 How to Verify
Check if Vulnerable:
Check if /sys/class/razer/matrix_custom_frame exists and OpenRazer version is ≤3.3.0.Check Version:
dpkg -l openrazer-driver-dkms || rpm -q openrazer-driver-dkms || check installed version manuallyVerify Fix Applied:
Verify OpenRazer version is ≥3.3.1 and device file has proper permissions.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- System crashes related to razeraccessory driver
- Unusual access to /sys/class/razer/matrix_custom_frame
Network Indicators:
- None - local exploitation only
SIEM Query:
process.name='razeraccessory' AND event.action='crash' OR file.path='/sys/class/razer/matrix_custom_frame' AND event.action='write'🔗 References
- https://github.com/openrazer/openrazer/pull/1790
- https://www.cyberark.com/resources/threat-research-blog/colorful-vulnerabilities
- https://github.com/openrazer/openrazer/pull/1790
- https://lists.debian.org/debian-lts-announce/2025/04/msg00032.html
- https://www.cyberark.com/resources/threat-research-blog/colorful-vulnerabilities
