UBUNTU-CVE-2019-2101

Description

In uvc_parse_standard_control of uvc_driver.c, there is a possible out-of-bound read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-111760968.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Systems

• ubuntu•linux

  all | < 4.4.0-148.174 | < 4.15.0-58.64

• ubuntu•linux-aws

  < 4.4.0-1044.47 | < 4.4.0-1083.93 | < 4.15.0-1047.49

• ubuntu•linux-aws-fips

  < 4.15.0-2018.18 | all

• ubuntu•linux-aws-hwe

  < 4.15.0-1047.49~16.04.1

• ubuntu•linux-azure

  < 4.15.0-1059.64~14.04.1

• ubuntu•linux-azure-fde

  all

• ubuntu•linux-azure-fips

  < 4.15.0-2006.7 | all

• ubuntu•linux-bluefield

  all

• ubuntu•linux-fips

  < 4.4.0-1008.10

• ubuntu•linux-gcp

  < 4.15.0-1040.42~16.04.1 | < 4.15.0-1040.42

• ubuntu•linux-gcp-fips

  all

• ubuntu•linux-gke

  all

• ubuntu•linux-gke-4.15

  < 4.15.0-1040.42

• ubuntu•linux-hwe

  < 4.15.0-58.64~16.04.1 | < 5.0.0-23.24~18.04.1

• ubuntu•linux-intel-iot-realtime

  all

• ubuntu•linux-kvm

  < 4.4.0-1046.52

• ubuntu•linux-lts-xenial

  < 4.4.0-148.174~14.04.1

• ubuntu•linux-nvidia

  all

• ubuntu•linux-oem

  < 4.15.0-1050.57

• ubuntu•linux-oracle

  < 4.15.0-1021.23~16.04.1 | < 4.15.0-1021.23

• ubuntu•linux-raspi-realtime

  all

• ubuntu•linux-raspi2

  < 4.4.0-1107.115 | < 4.15.0-1043.46 | all

• ubuntu•linux-realtime

  all

• ubuntu•linux-riscv

  all | all

• ubuntu•linux-snapdragon

  < 4.4.0-1111.116 | < 4.15.0-1060.66

References (5)

• https://ubuntu.com/security/CVE-2019-2101
• https://source.android.com/security/bulletin/2019-06-01
• https://ubuntu.com/security/notices/USN-4094-1
• https://ubuntu.com/security/notices/USN-4118-1
• https://www.cve.org/CVERecord?id=CVE-2019-2101