CVE-2019-18683
Published: 4 November 2019
An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded. There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free.
From the Ubuntu Security Team
It was discovered that a race condition existed in the Virtual Video Test Driver in the Linux kernel. An attacker with write access to /dev/video0 on a system with the vivid module loaded could possibly use this to gain administrative privileges.
Notes
Author | Note |
---|---|
tyhicks | This rarely used driver module cannot be loaded by an unprivileged user so the impact is lessened |
Priority
Status
Package | Release | Status |
---|---|---|
linux-aws Launchpad, Ubuntu, Debian |
upstream |
Released
(5.5~rc1)
|
trusty |
Released
(4.4.0-1061.65)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
xenial |
Released
(4.4.0-1101.112)
|
|
bionic |
Released
(4.15.0-1060.62)
|
|
disco |
Ignored
(end of life, was pending)
|
|
eoan |
Released
(5.3.0-1011.12)
|
|
focal |
Not vulnerable
(5.4.0-1005.5)
|
|
linux-aws-hwe Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.15.0-1060.62~16.04.1)
|
|
linux-aws-5.0 Launchpad, Ubuntu, Debian |
upstream |
Released
(5.5~rc1)
|
trusty |
Does not exist
|
|
xenial |
Does not exist
|
|
bionic |
Released
(5.0.0-1024.27~18.04.1)
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
linux-azure-5.3 Launchpad, Ubuntu, Debian |
disco |
Does not exist
|
bionic |
Released
(5.3.0-1013.14~18.04.1)
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-azure-4.15 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(4.15.0-1082.92)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-aws-5.3 Launchpad, Ubuntu, Debian |
upstream |
Released
(5.5~rc1)
|
trusty |
Does not exist
|
|
xenial |
Does not exist
|
|
bionic |
Not vulnerable
(5.3.0-1016.17~18.04.1)
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
linux Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-88.88)
|
disco |
Ignored
(end of life, was pending)
|
|
eoan |
Released
(5.3.0-40.32)
|
|
focal |
Not vulnerable
(5.4.0-9.12)
|
|
trusty |
Ignored
(was needs-triage ESM criteria)
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.4.0-173.203)
|
|
Patches: Introduced by 3f682ffcf957b556a7868decd5593d765ed3455d Introduced by 6de8653f410c5413a557eb48e2492a93f7af664b |
||
linux-azure Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1029.31~18.04.1)
|
disco |
Ignored
(end of life, was pending)
|
|
eoan |
Released
(5.3.0-1013.14)
|
|
focal |
Not vulnerable
(5.4.0-1006.6)
|
|
trusty |
Released
(4.15.0-1071.76~14.04.1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.15.0-1071.76)
|
|
linux-azure-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gcp Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1029.30~18.04.1)
|
disco |
Ignored
(end of life, was pending)
|
|
eoan |
Released
(5.3.0-1012.13)
|
|
focal |
Not vulnerable
(5.4.0-1005.5)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.15.0-1055.59)
|
|
linux-gcp-4.15 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(4.15.0-1071.81)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gcp-5.3 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1012.13~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gcp-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gke-4.15 Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1052.55)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gke-5.0 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1029.30~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gke-5.3 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1012.13~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-hwe Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-40.32~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.15.0-88.88~16.04.1)
|
|
linux-hwe-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needed)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Ignored
(end of life, was needed)
|
|
linux-kvm Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1053.53)
|
disco |
Ignored
(end of life, was pending)
|
|
eoan |
Released
(5.3.0-1010.11)
|
|
focal |
Not vulnerable
(5.4.0-1004.4)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.4.0-1065.72)
|
|
linux-lts-trusty Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-lts-xenial Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Released
(4.4.0-173.203~14.04.1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-oem Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1073.83)
|
disco |
Ignored
(end of life)
|
|
eoan |
Ignored
(end of life, was pending)
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Ignored
(end of standard support, was needs-triage)
|
|
linux-oem-5.6 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
eoan |
Does not exist
|
|
focal |
Not vulnerable
(5.6.0-1007.7)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-oem-osp1 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1037.42)
|
disco |
Ignored
(end of life)
|
|
eoan |
Released
(5.0.0-1037.42)
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-oracle Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1033.36)
|
disco |
Ignored
(end of life, was pending)
|
|
eoan |
Released
(5.3.0-1009.10)
|
|
focal |
Not vulnerable
(5.4.0-1005.5)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.15.0-1033.36~16.04.1)
|
|
linux-oracle-5.0 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1010.15~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-oracle-5.3 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.3.0-1011.12~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-raspi Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
eoan |
Does not exist
|
|
focal |
Not vulnerable
(5.4.0-1007.7)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-raspi2 Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1055.59)
|
disco |
Ignored
(end of life, was pending)
|
|
eoan |
Released
(5.3.0-1018.20)
|
|
focal |
Ignored
(end of life, was needed)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.4.0-1128.137)
|
|
linux-raspi2-5.3 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1018.20~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-riscv Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
eoan |
Does not exist
|
|
focal |
Not vulnerable
(5.4.0-24.28)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-snapdragon Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1072.79)
|
disco |
Ignored
(end of life, was pending)
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.4.0-1132.140)
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.0 |
Attack vector | Local |
Attack complexity | High |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18683
- https://www.openwall.com/lists/oss-security/2019/11/02/1
- https://lore.kernel.org/lkml/20191103221719.27118-1-alex.popov@linux.com/
- https://ubuntu.com/security/notices/USN-4254-1
- https://ubuntu.com/security/notices/USN-4254-2
- https://ubuntu.com/security/notices/USN-4258-1
- https://ubuntu.com/security/notices/USN-4284-1
- https://ubuntu.com/security/notices/USN-4287-1
- https://ubuntu.com/security/notices/USN-4287-2
- NVD
- Launchpad
- Debian