CVE-2019-2054Authentication Bypass by Primary Weakness in Google Android

Severity
7.8HIGHNVD
OSV8.1OSV6.8
EPSS
0.3%
top 42.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMay 8
Latest updateMay 24

Description

In the seccomp implementation prior to kernel version 4.8, there is a possible seccomp bypass due to seccomp policies that allow the use of ptrace. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-119769499

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

Debianlinux/linux_kernel< 4.8.5-1+3
Ubuntulinux/linux_kernel< 4.4.0-157.185
debiandebian/linux< linux 4.8.5-1 (bookworm)

Also affects: Ubuntu Linux 14.04, 16.04

🔴Vulnerability Details

4
GHSA
GHSA-qgfr-27qf-f323: In the seccomp implementation prior to kernel version 42022-05-24
OSV
linux-lts-xenial, linux-aws vulnerabilities2019-08-13
OSV
linux, linux-aws, linux-kvm, linux-raspi2 vulnerabilities2019-07-25
OSV
CVE-2019-2054: In the seccomp implementation prior to kernel version 42019-05-08

📋Vendor Advisories

5
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities2019-08-13
Ubuntu
Linux kernel vulnerabilities2019-07-25
Red Hat
kernel: seccompass mechanism bypass2019-05-01
Android
CVE-2019-2054: seccomp2019-05-01
Debian
CVE-2019-2054: linux - In the seccomp implementation prior to kernel version 4.8, there is a possible s...2019

💬Community

1
Bugzilla
CVE-2019-2054 kernel: seccompass mechanism bypass2019-05-14