CVE-2019-18683

Advisory lineage Upstream: 0 Downstream: 22
Modified
Published: 04 Nov 2019, 15:36
Last modified:05 Aug 2024, 02:02

Vulnerability Summary

Overall Risk (default)
medium
38/100
CVSS Score
7 HIGH
v3.1 (nvd)
EPSS Score
0.89% LOW
1% probability -0.10%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected

Timeline

04 Nov 2019, 15:36
Published
Vulnerability first disclosed
05 Aug 2024, 02:02
Last Modified
Vulnerability information updated

Description

An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded. There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free.

CVSS Metrics

  • v3.1•HIGH•Score: 7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • v2.0•MEDIUM•Score: 6.9AV:L/AC:M/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 0.89%• Percentile: 76%

Techniques & Countermeasures

  • CWE-362•Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

    The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

  • CWE-416•Use After Free

    The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected Systems

  • broadcom•fabric_operating_system

    na

  • canonical•ubuntu_linux

    14.04 | 16.04 | 18.04 | 19.10

  • debian•debian_linux

    8.0

  • linux•linux_kernel

    ≥ 3.18, < 4.4.204 | ≥ 4.5, < 4.9.204 | ≥ 4.10, < 4.14.157 | ≥ 4.15, < 4.19.87 | ≥ 4.20, < 5.3.14 | ≥ 5.4, < 5.4.1

  • netapp•8300_firmware

    na

  • netapp•8700_firmware

    na

  • netapp•a400_firmware

    na

  • netapp•a700s_firmware

    na

  • netapp•active_iq_unified_manager

    na

  • netapp•cloud_backup

    na

  • netapp•data_availability_services

    na

  • netapp•e-series_santricity_os_controller

    ≥ 11.0.0, ≤ 11.70.1

  • netapp•element_software

    na

  • netapp•h610s_firmware

    na

  • netapp•hci_management_node

    na

  • netapp•solidfire

    na

  • netapp•steelstore_cloud_integrated_storage

    na

  • opensuse•leap

    15.1

References (14)