Race condition in Linux kernel - CVE-2019-18683

Vulnerability identifier: #VU22567

CSH Severity: Low

CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-18683

CWE-ID: CWE-362

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition, caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Successful exploitation of the vulnerability requires access to /dev/video0.

Linux kernel
Slackware Linux
Ubuntu
linux (Ubuntu package)
linux-raspi2 (Ubuntu package)
linux-kvm (Ubuntu package)
linux-aws (Ubuntu package)
linux-snapdragon (Ubuntu package)
linux-hwe (Ubuntu package)
linux-gcp (Ubuntu package)
linux-azure (Ubuntu package)
linux-oracle (Ubuntu package)
linux-gke-4.15 (Ubuntu package)
linux-aws-hwe (Ubuntu package)
linux-oracle-5.0 (Ubuntu package)
linux-gke-5.0 (Ubuntu package)
linux-aws-5.0 (Ubuntu package)
linux-azure-5.3 (Ubuntu package)
linux-gcp-5.3 (Ubuntu package)
linux-raspi2-5.3 (Ubuntu package)

Install updates from vendor's website.

Linux kernel - update to 5.3.9
linux (Ubuntu package) - addressed in versions 4.4.0-173.203, 4.15.0-88.88, 5.3.0-40.32
linux-raspi2 (Ubuntu package) - addressed in versions 4.4.0-1128.137, 4.15.0-1055.59, 5.3.0-1018.20
linux-kvm (Ubuntu package) - addressed in versions 4.4.0-1065.72, 4.15.0-1053.53, 5.3.0-1010.11
linux-aws (Ubuntu package) - addressed in versions 4.4.0-1101.112, 4.15.0-1060.62, 5.3.0-1011.12
linux-snapdragon (Ubuntu package) - addressed in versions 4.4.0-1132.140, 4.15.0-1072.79
linux-hwe (Ubuntu package) - addressed in versions 4.15.0-88.88~16.04.1, 5.3.0-40.32~18.04.1
linux-gcp (Ubuntu package) - addressed in versions 4.15.0-1055.59, 5.0.0-1029.30~18.04.1, 5.3.0-1012.13
linux-azure (Ubuntu package) - addressed in versions 4.15.0-1071.76, 5.3.0-1013.14
linux-oracle (Ubuntu package) - addressed in versions 4.15.0-1033.36~16.04.1, 4.15.0-1033.36, 5.3.0-1009.10
linux-gke-4.15 (Ubuntu package) - update to 4.15.0-1052.55
linux-aws-hwe (Ubuntu package) - update to 4.15.0-1060.62~16.04.1
linux-oracle-5.0 (Ubuntu package) - update to 5.0.0-1010.15~18.04.1
linux-gke-5.0 (Ubuntu package) - update to 5.0.0-1029.30~18.04.1
linux-aws-5.0 (Ubuntu package) - update to 5.0.0-1024.27~18.04.1
linux-azure-5.3 (Ubuntu package) - update to 5.3.0-1013.14~18.04.1
linux-gcp-5.3 (Ubuntu package) - update to 5.3.0-1012.13~18.04.1
linux-raspi2-5.3 (Ubuntu package) - update to 5.3.0-1018.20~18.04.1

• http://www.openwall.com/lists/oss-security/2019/11/05/1
• https://lore.kernel.org/lkml/20191103221719.27118-1-alex.popov@linux.com/
• https://www.openwall.com/lists/oss-security/2019/11/02/1
• https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2019-05/

• Multiple vulnerabilities in Linux kernel
• Slackware Linux update for Slackware 14.2 kernel
• Ubuntu update for linux, linux-aws, linux-kvm and more
• Ubuntu update for linux-aws-5.0, linux-gcp, linux-gke-5.0 and more
• Ubuntu update for linux, linux-aws, linux-azure and more
• Ubuntu update for linux, linux-aws, linux-aws-hwe and more