CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
10.1%
Linux Kernel from version 3.18 up to 5.4
Severity:
Severity level: High
Impact: Privilege Escalation
Access Vector: Local
CVSS v3 Base Score: 7.0 HIGH
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE: CVE-2019-18683
Vulnerability description:
Alexander Popov at Positive Technologies discovered an issue in drivers/media/platform/vivid in the Linux kernel. It is exploitable for privilege escalation on some Linux distributions wh ere local users have /dev/video0 access, but only if the driver happens to be loaded.
There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free.
How to fix:
Alexander Popov at Positive Technologies prepared fixes for CVE-2019-18683, which were merged into the Linux kernel 5.4:
<https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6dcd5d7a7a29c1e4b8016a06aed78cd650cd8c27>
Advisory status:
01.11.2019 - Linux kernel security team gets vulnerability details and fixes
02.11.2019 - Linux kernel security team allows full disclosure
02.11.2019 - Full disclosure at oss-security mailing list
08.11.2019 - Final version of the fixing patch is accepted for the mainline
Credits:
The vulnerability was discovered and fixed by Alexander Popov, Positive Technologies
References:
<https://www.openwall.com/lists/oss-security/2019/11/02/1>
<https://vulners.com/cve/CVE-2019-18683>
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
10.1%