title: Location service uses cached authorization even after revocation
description: In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. This is because the cache was not ordered by creation time by the Select struct in src/core/trust/impl/sqlite3/store.cpp. Fixed in trust-store (Ubuntu) version 1.1.0+15.04.20150123-0ubuntu1 and trust-store (Ubuntu RTM) version 1.1.0+15.04.20150123~rtm-0ubuntu1.
problem types: CWE-275 Permission Issues
affected:
{
product: trust-store (Ubuntu)
vendor: Canonical
versions:
lessThan: 1.1.0+15.04.20150123-0ubuntu1, status: affected, version: 1.1.0, versionType: custom
}
{
product: trust-store (Ubuntu RTM)
vendor: Canonical
versions:
lessThan: 1.1.0+15.04.20150123~rtm-0ubuntu1, status: affected, version: 1.1.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
]