CVE-2019-18675 Integer overflow in n/a
Local attackers with video device access can exploit an integer overflow in the Linux kernel to read and write kernel memory, potentially escalating privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-18675?
CVE-2019-18675 is a high-severity vulnerability in Linux kernel, published on 25 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Linux kernel through 5.3.13 has a start_offset+size Integer Overflow in cpia2_remap_buffer in drivers/media/usb/cpia2/cpia2_core.c because cpia2 has its own mmap implementation. This allows local users (with /dev/video0 access) to obtain read and write permissions on kernel physical pages, which can possibly result in a privilege escalation.
Weakness: CWE-190
Which versions are affected by CVE-2019-18675?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2019-18675?
Apply the vendor's patch.
Is CVE-2019-18675 being exploited?
There is no known exploitation of CVE-2019-18675 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2019-18675, GHSA-7xj8-cwpp-wfwj, UBUNTU-CVE-2019-18675.