CVE-2018-9516

Published: 6 November 2018

In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-71361580.

From the Ubuntu security team

It was discovered that the debug interface for the Linux kernel's HID subsystem did not properly perform bounds checking in some situations. An attacker with access to debugfs could use this to cause a denial of service or possibly gain additional privileges.

Priority

Negligible

CVSS 3 base score: 7.8

Status

Notes

HID debug events are exposed via debugfs which is only accessible by
the root user in Ubuntu

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9516
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=717adfdaf14704fd3ec7fa2c04520c0723247eac
• https://source.android.com/security/bulletin/pixel/2018-09-01
• https://ubuntu.com/security/notices/USN-3871-1
• https://ubuntu.com/security/notices/USN-3871-3
• https://ubuntu.com/security/notices/USN-3871-4
• https://ubuntu.com/security/notices/USN-3871-5
• NVD
• Launchpad
• Debian

Bugs