CVE-2019-2101

Published: 7 June 2019

In uvc_parse_standard_control of uvc_driver.c, there is a possible out-of-bound read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-111760968.

From the Ubuntu Security Team

It was discovered that the USB video device class implementation in the Linux kernel did not properly validate control bits, resulting in an out of bounds buffer read. A local attacker could use this to possibly expose sensitive information (kernel memory).

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2101
• https://source.android.com/security/bulletin/2019-06-01
• https://ubuntu.com/security/notices/USN-4094-1
• https://ubuntu.com/security/notices/USN-4118-1
• NVD
• Launchpad
• Debian