CVE-2019-18683
Published: 4 November 2019
An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded. There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free.
From the Ubuntu Security Team
It was discovered that a race condition existed in the Virtual Video Test Driver in the Linux kernel. An attacker with write access to /dev/video0 on a system with the vivid module loaded could possibly use this to gain administrative privileges.
Notes
Author | Note |
---|---|
tyhicks |
This rarely used driver module cannot be loaded by an unprivileged user so the impact is lessened |
Priority
Status
Package | Release | Status |
---|---|---|
linux
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-88.88)
|
disco |
Ignored
(end of life, was pending)
|
|
eoan |
Released
(5.3.0-40.32)
|
|
focal |
Not vulnerable
(5.4.0-9.12)
|
|
trusty |
Ignored
(was needs-triage ESM criteria)
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.4.0-173.203)
|
|
Patches:
Introduced by
3f682ffcf957b556a7868decd5593d765ed3455d
Introduced by
6de8653f410c5413a557eb48e2492a93f7af664b
|
||
linux-aws
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1060.62)
|
disco |
Ignored
(end of life, was pending)
|
|
eoan |
Released
(5.3.0-1011.12)
|
|
focal |
Not vulnerable
(5.4.0-1005.5)
|
|
trusty |
Released
(4.4.0-1061.65)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.4.0-1101.112)
|
|
linux-aws-5.0
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1024.27~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-aws-5.3
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.3.0-1016.17~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-aws-hwe
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.15.0-1060.62~16.04.1)
|
|
linux-azure
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1029.31~18.04.1)
|
disco |
Ignored
(end of life, was pending)
|
|
eoan |
Released
(5.3.0-1013.14)
|
|
focal |
Not vulnerable
(5.4.0-1006.6)
|
|
trusty |
Released
(4.15.0-1071.76~14.04.1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.15.0-1071.76)
|
|
linux-azure-4.15
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(4.15.0-1082.92)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-azure-5.3
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1013.14~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-azure-edge
Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gcp
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1029.30~18.04.1)
|
disco |
Ignored
(end of life, was pending)
|
|
eoan |
Released
(5.3.0-1012.13)
|
|
focal |
Not vulnerable
(5.4.0-1005.5)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.15.0-1055.59)
|
|
linux-gcp-4.15
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(4.15.0-1071.81)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gcp-5.3
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1012.13~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gcp-edge
Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needs-triage)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gke-4.15
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1052.55)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gke-5.0
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1029.30~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-gke-5.3
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1012.13~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-hwe
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-40.32~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.15.0-88.88~16.04.1)
|
|
linux-hwe-edge
Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of life, was needed)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Ignored
(end of life, was needed)
|
|
linux-kvm
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1053.53)
|
disco |
Ignored
(end of life, was pending)
|
|
eoan |
Released
(5.3.0-1010.11)
|
|
focal |
Not vulnerable
(5.4.0-1004.4)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.4.0-1065.72)
|
|
linux-lts-trusty
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-lts-xenial
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Released
(4.4.0-173.203~14.04.1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-oem
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1073.83)
|
disco |
Ignored
(end of life)
|
|
eoan |
Ignored
(end of life, was pending)
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Ignored
(end of standard support, was needs-triage)
|
|
linux-oem-5.6
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
eoan |
Does not exist
|
|
focal |
Not vulnerable
(5.6.0-1007.7)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-oem-osp1
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1037.42)
|
disco |
Ignored
(end of life)
|
|
eoan |
Released
(5.0.0-1037.42)
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-oracle
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1033.36)
|
disco |
Ignored
(end of life, was pending)
|
|
eoan |
Released
(5.3.0-1009.10)
|
|
focal |
Not vulnerable
(5.4.0-1005.5)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.15.0-1033.36~16.04.1)
|
|
linux-oracle-5.0
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1010.15~18.04.1)
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-oracle-5.3
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(5.3.0-1011.12~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-raspi
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
eoan |
Does not exist
|
|
focal |
Not vulnerable
(5.4.0-1007.7)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-raspi2
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1055.59)
|
disco |
Ignored
(end of life, was pending)
|
|
eoan |
Released
(5.3.0-1018.20)
|
|
focal |
Ignored
(end of life, was needed)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.4.0-1128.137)
|
|
linux-raspi2-5.3
Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1018.20~18.04.1)
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-riscv
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
eoan |
Does not exist
|
|
focal |
Not vulnerable
(5.4.0-24.28)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Does not exist
|
|
linux-snapdragon
Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1072.79)
|
disco |
Ignored
(end of life, was pending)
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.5~rc1)
|
|
xenial |
Released
(4.4.0-1132.140)
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.0 |
Attack vector | Local |
Attack complexity | High |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
References
- https://www.openwall.com/lists/oss-security/2019/11/02/1
- https://lore.kernel.org/lkml/20191103221719.27118-1-alex.popov@linux.com/
- https://ubuntu.com/security/notices/USN-4254-1
- https://ubuntu.com/security/notices/USN-4254-2
- https://ubuntu.com/security/notices/USN-4258-1
- https://ubuntu.com/security/notices/USN-4284-1
- https://ubuntu.com/security/notices/USN-4287-1
- https://ubuntu.com/security/notices/USN-4287-2
- https://www.cve.org/CVERecord?id=CVE-2019-18683
- NVD
- Launchpad
- Debian