HOME VULNERABILITIESCVE-2019-18683

HIGH

CVE-2019-18683

CWE-362Published: November 4, 2019· Updated: Jun 17, 2026

7.0

CVSS v3.1

Official Description

An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded. There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free.

Technical Analysis

CVE-2019-18683 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.0.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityHigh

Privileges Req.Low

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

broadcom1 product(s)

fabric operating system

Canonical1 product(s)

ubuntu linux

Debian1 product(s)

debian linux

Linux1 product(s)

linux kernel

netapp18 product(s)

active iq unified managercloud backupdata availability servicese-series santricity os controllerelement softwarehci management nodesolidfiresteelstore cloud integrated storagea700s firmwarea700s8300 firmware8300+6

openSUSE1 product(s)

leap

Source: NVD CPE · 26 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

Security advisories & exploits

Official NIST entry

CVE Program entry

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttps://seclists.org/bugtraq/2020/Jan/10

PATCHhttps://seclists.org/bugtraq/2020/Jan/10

ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html

ADVISORYhttp://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html

ADVISORYhttp://www.openwall.com/lists/oss-security/2019/11/05/1

ADVISORYhttps://lists.debian.org/debian-lts-announce/2020/03/msg00001.html

ADVISORYhttps://lore.kernel.org/lkml/20191103221719.27118-1-alex.popov%40linux.com/

ADVISORYhttps://security.netapp.com/advisory/ntap-20191205-0001/

ADVISORYhttps://usn.ubuntu.com/4254-1/

ADVISORYhttps://usn.ubuntu.com/4254-2/

ADVISORYhttps://usn.ubuntu.com/4258-1/

ADVISORYhttps://usn.ubuntu.com/4284-1/

ADVISORYhttps://usn.ubuntu.com/4287-1/

ADVISORYhttps://usn.ubuntu.com/4287-2/

ADVISORYhttps://www.openwall.com/lists/oss-security/2019/11/02/1

ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html

ADVISORYhttp://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html

ADVISORYhttp://www.openwall.com/lists/oss-security/2019/11/05/1

ADVISORYhttps://lists.debian.org/debian-lts-announce/2020/03/msg00001.html

ADVISORYhttps://lore.kernel.org/lkml/20191103221719.27118-1-alex.popov%40linux.com/

ADVISORYhttps://security.netapp.com/advisory/ntap-20191205-0001/

ADVISORYhttps://usn.ubuntu.com/4254-1/

ADVISORYhttps://usn.ubuntu.com/4254-2/

ADVISORYhttps://usn.ubuntu.com/4258-1/

ADVISORYhttps://usn.ubuntu.com/4284-1/

ADVISORYhttps://usn.ubuntu.com/4287-1/

ADVISORYhttps://usn.ubuntu.com/4287-2/

ADVISORYhttps://www.openwall.com/lists/oss-security/2019/11/02/1

All References (28)

→

http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.htmlMailing List · Third Party Advisory

→

http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlThird Party Advisory · VDB Entry

→

http://www.openwall.com/lists/oss-security/2019/11/05/1Exploit · Mailing List · Third Party Advisory

→

https://lists.debian.org/debian-lts-announce/2020/03/msg00001.htmlMailing List · Third Party Advisory

→

https://lore.kernel.org/lkml/20191103221719.27118-1-alex.popov%40linux.com/Vendor Advisory

→

https://seclists.org/bugtraq/2020/Jan/10Mailing List · Patch · Third Party Advisory

→

https://security.netapp.com/advisory/ntap-20191205-0001/Third Party Advisory

→

https://usn.ubuntu.com/4254-1/Third Party Advisory

→

https://usn.ubuntu.com/4254-2/Third Party Advisory

→

https://usn.ubuntu.com/4258-1/Third Party Advisory

→

https://usn.ubuntu.com/4284-1/Third Party Advisory

→

https://usn.ubuntu.com/4287-1/Third Party Advisory

→

https://usn.ubuntu.com/4287-2/Third Party Advisory

→

https://www.openwall.com/lists/oss-security/2019/11/02/1Exploit · Mailing List · Third Party Advisory

→

http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.htmlMailing List · Third Party Advisory

Quick Facts

CVE IDCVE-2019-18683

CVSS Score7.0 / 10

SeverityHIGH

WeaknessCWE-362

CISA KEVNo

Affected6 vendor(s)

PublishedNov 4, 2019

Related CVEs (CWE-362)

Recommended Actions

→Apply vendor patches immediately
→Monitor CVE-2019-18683 in threat intel feeds
→Review IDS/IPS signatures for exploitation attempts

Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWatch. CVE data is provided under the NVD usage policy.

← All Vulnerabilities·Search for CVE-2019-18683·NVD