CVE-2019-14088: Google Android V4l2 cam_actuator_driver_cmd Use-After-Free Privilege Escalation Vulnerability
Possible use after free issue while CRM is accessing the link pointer from device private data due to lack of resource protection in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, MDM9206, MDM9207C, MDM9607, QCS605, SDM429W, SDX24, SM8150, SXR1130
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Google Android. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the camactuatordrivercmd function in the V4l2 driver. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the kernel.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-14088?
CVE-2019-14088 is classified as a high-severity vulnerability due to the potential for exploitation through a use-after-free issue.
How do I fix CVE-2019-14088?
To fix CVE-2019-14088, ensure that your affected Qualcomm device firmware is updated to the latest available version from the manufacturer.
What devices are affected by CVE-2019-14088?
CVE-2019-14088 affects various Qualcomm devices including APQ8009, MDM9206, MDM9207C, and several others across Snapdragon platforms.
What are the potential impacts of exploiting CVE-2019-14088?
Exploitation of CVE-2019-14088 could lead to unauthorized access or control over the device, potentially compromising user data and privacy.
Is there a workaround for CVE-2019-14088?
Currently, the recommended solution for CVE-2019-14088 is to update firmware, as no known workarounds can effectively mitigate the vulnerability.