CVE-2020-13696

An issue was discovered in LinuxTV xawtv before 3.107. The function
dev_open() in v4l-conf.c does not perform sufficient checks to prevent an
unprivileged caller of the program from opening unintended filesystem
paths. This allows a local attacker with access to the v4l-conf setuid-root
program to test for the existence of arbitrary files and to trigger an open
on arbitrary files with mode O_RDWR. To achieve this, relative path
components need to be added to the device path, as demonstrated by a
v4l-conf -c /dev/…/root/.bash_history command.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=962221&gt;