PT-2019-05: Local privilege escalation
Linux Kernel from version 3.18 up to 5.4
Severity level: High
Impact: Privilege Escalation
Access Vector: Local
CVSS v3 Base Score: 7.0 HIGH
Alexander Popov at Positive Technologies discovered an issue in drivers/media/platform/vivid in the Linux kernel. It is exploitable for privilege escalation on some Linux distributions wh ere local users have /dev/video0 access, but only if the driver happens to be loaded.
There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free.
How to fix:
Alexander Popov at Positive Technologies prepared fixes for CVE-2019-18683, which were merged into the Linux kernel 5.4:
01.11.2019 - Linux kernel security team gets vulnerability details and fixes
02.11.2019 - Linux kernel security team allows full disclosure
02.11.2019 - Full disclosure at oss-security mailing list
08.11.2019 - Final version of the fixing patch is accepted for the mainline
The vulnerability was discovered and fixed by Alexander Popov, Positive Technologies