Race condition in Linux kernel - CVE-2019-18683

Detailed vulnerability description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition, caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Successful exploitation of the vulnerability requires access to /dev/video0.

How to mitigate CVE-2019-18683

Sources

• http://www.openwall.com/lists/oss-security/2019/11/05/1
• https://lore.kernel.org/lkml/20191103221719.27118-1-alex.popov@linux.com/
• https://www.openwall.com/lists/oss-security/2019/11/02/1
• https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2019-05/