Ubuntu.comUB:CVE-2019-2054CVE-2019-2054
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
0.0004 Low
EPSS
Percentile
9.0%
In the seccomp implementation prior to kernel version 4.8, there is a
possible seccomp bypass due to seccomp policies that allow the use of
ptrace. This could lead to local escalation of privilege with no additional
execution privileges needed. User interaction is not needed for
exploitation. Product: Android Versions: Android kernel Android ID:
A-119769499
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 16.04 | noarch | linux | < 4.4.0-157.185 | UNKNOWN |
| ubuntu | 14.04 | noarch | linux-aws | < 4.4.0-1050.54) Available with Ubuntu Pro or Ubuntu Pro (Infra-only | UNKNOWN |
| ubuntu | 16.04 | noarch | linux-aws | < 4.4.0-1090.101 | UNKNOWN |
| ubuntu | 16.04 | noarch | linux-kvm | < 4.4.0-1052.59 | UNKNOWN |
| ubuntu | 14.04 | noarch | linux-lts-xenial | < 4.4.0-157.185~14.04.1) Available with Ubuntu Pro or Ubuntu Pro (Infra-only | UNKNOWN |
| ubuntu | 16.04 | noarch | linux-raspi2 | < 4.4.0-1117.126 | UNKNOWN |
| ubuntu | 18.04 | noarch | linux-snapdragon | < 4.15.0-1053.57 | UNKNOWN |
| ubuntu | 16.04 | noarch | linux-snapdragon | < 4.4.0-1121.127 | UNKNOWN |
References
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0f3912fd934cdfd03d93f2dc6f064099795bf638
github.com/GrapheneOS/kernel_google_marlin/commit/bac2f2dde8af50c477b580743deb688db25e9e63
launchpad.net/bugs/cve/CVE-2019-2054
nvd.nist.gov/vuln/detail/CVE-2019-2054
security-tracker.debian.org/tracker/CVE-2019-2054
source.android.com/security/bulletin/2019-05-01
ubuntu.com/security/notices/USN-4076-1
ubuntu.com/security/notices/USN-4095-2
www.cve.org/CVERecord?id=CVE-2019-2054
Related
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
0.0004 Low
EPSS
Percentile
9.0%