An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded. There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Feb 24, 2020 | Nov 4, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade kernel-develUpgrade kernel-tools-libsUpgrade python3-perfUpgrade perfUpgrade kernel-sourceUpgrade bpftoolUpgrade kernel-toolsUpgrade kernelUpgrade kernel-headersUpgrade python-perf | Jan 3, 2020 | Nov 4, 2019 |
| Suse | — | Upgrade kernel-obs-buildUpgrade kernel-defaultUpgrade kernel-default-extraUpgrade kernel-docs | Dec 7, 2019 | Nov 4, 2019 |
| Ubuntu | — | Upgrade linux-image-4.4.0-173-powerpc64-smpUpgrade linux-image-oracleUpgrade linux-image-4.4.0-173-generic-lpaeUpgrade linux-image-gkeUpgrade linux-image-powerpc-smpUpgrade linux-image-5.3.0-1011-awsUpgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-4.4.0-1132-snapdragonUpgrade linux-image-5.3.0-40-genericUpgrade linux-image-4.15.0-1071-azureUpgrade linux-image-4.15.0-1055-gcpUpgrade linux-image-aws-lts-18.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-generic-lts-xenialUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-powerpc64-smpUpgrade linux-image-aws-hweUpgrade linux-image-4.4.0-1128-raspi2Upgrade linux-image-raspi2-hwe-18.04Upgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-snapdragonUpgrade linux-image-generic-lpaeUpgrade linux-image-genericUpgrade linux-image-oemUpgrade linux-image-4.4.0-173-powerpc-smpUpgrade linux-image-aws-edgeUpgrade linux-image-powerpc-e500mcUpgrade linux-image-5.3.0-1013-azureUpgrade linux-image-4.15.0-1060-awsUpgrade linux-image-4.15.0-1069-azureUpgrade linux-image-4.4.0-173-genericUpgrade linux-image-4.15.0-88-generic-lpaeUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-4.15.0-88-lowlatencyUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.3.0-1010-kvmUpgrade linux-image-oracle-edgeUpgrade linux-image-5.0.0-1029-gcpUpgrade linux-image-powerpc-smp-lts-xenialUpgrade linux-image-5.0.0-1024-awsUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-4.15.0-1053-kvmUpgrade linux-image-gke-5.0Upgrade linux-image-generic-hwe-16.04Upgrade linux-image-5.0.0-1029-gkeUpgrade linux-image-azure-edgeUpgrade linux-image-4.15.0-1072-snapdragonUpgrade linux-image-kvmUpgrade linux-image-4.4.0-1061-awsUpgrade linux-image-4.15.0-88-genericUpgrade linux-image-4.15.0-1055-raspi2Upgrade linux-image-4.15.0-1033-oracleUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-5.3.0-40-generic-lpaeUpgrade linux-image-generic-lpae-hwe-16.04Upgrade linux-image-5.3.0-1018-raspi2Upgrade linux-image-powerpc64-smp-lts-xenialUpgrade linux-image-4.4.0-1101-awsUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-gke-4.15Upgrade linux-image-raspi2Upgrade linux-image-4.4.0-1065-kvmUpgrade linux-image-powerpc64-embUpgrade linux-image-4.4.0-173-powerpc-e500mcUpgrade linux-image-5.3.0-40-lowlatencyUpgrade linux-image-5.3.0-1009-oracleUpgrade linux-image-azureUpgrade linux-image-gcp-edgeUpgrade linux-image-5.3.0-1012-gcpUpgrade linux-image-5.0.0-1010-oracleUpgrade linux-image-4.4.0-173-lowlatencyUpgrade linux-image-5.3.0-40-snapdragonUpgrade linux-image-generic-lpae-lts-xenialUpgrade linux-image-lowlatencyUpgrade linux-image-powerpc-e500mc-lts-xenialUpgrade linux-image-powerpc64-emb-lts-xenialUpgrade linux-image-4.4.0-173-powerpc64-embUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-4.15.0-1052-gkeUpgrade linux-image-awsUpgrade linux-image-gcpUpgrade linux-image-virtual | Jan 29, 2020 | Nov 4, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub