CVE-2022-3421

CVE-2022-3421 is a local privilege escalation vulnerability affecting Google Drive for Desktop on macOS. An attacker can pre-create a specific directory, allowing them to replace a legitimate binary with a symlink. When the installer runs, it sets the setuid bit on this symlink, enabling the attacker to execute arbitrary code with root privileges. The vulnerability has a CVSS score of 7.3 (High), indicating a local attack vector with low complexity and requiring user interaction, but leading to high impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage regarding this CVE. Organizations are advised to upgrade Google Drive for Desktop to version 64.0 or later to mitigate this risk.