PT-2019-05: Local privilege escalation

Linux Kernel from version 3.18 up to 5.4

Severity:

Severity level: High
Impact: Privilege Escalation
Access Vector: Local

CVSS v3 Base Score: 7.0 HIGH
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2019-18683

Vulnerability description:

Alexander Popov at Positive Technologies discovered an issue in drivers/media/platform/vivid in the Linux kernel. It is exploitable for privilege escalation on some Linux distributions wh ere local users have /dev/video0 access, but only if the driver happens to be loaded.

There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free.

How to fix:

Alexander Popov at Positive Technologies prepared fixes for CVE-2019-18683, which were merged into the Linux kernel 5.4:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6dcd5d7a7a29c1e4b8016a06aed78cd650cd8c27

Advisory status:

01.11.2019 - Linux kernel security team gets vulnerability details and fixes
02.11.2019 - Linux kernel security team allows full disclosure
02.11.2019 - Full disclosure at oss-security mailing list
08.11.2019 - Final version of the fixing patch is accepted for the mainline

Credits:

The vulnerability was discovered and fixed by Alexander Popov, Positive Technologies

References:

https://www.openwall.com/lists/oss-security/2019/11/02/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18683

Threatscape