CVE-2019-2182: High severity Google Android vulnerability

Published Sep 6, 2019

Updated

In the Android kernel in the kernel MMU code there is a possible execution path leaving some kernel text and rodata pages writable. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

2 affected componentsFixes available

Google Android

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1

Event History

Sep 6, 2019

CVE Published

via MITRE·09:44 PM

Data Sourced

via MITRE·09:44 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

DSA-4698

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-2242-1

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker needs local access and low-level privileges. No user interaction or additional execution privileges are required.

What is the potential impact of successful exploitation?

Successful exploitation can allow local escalation of privilege. The CVSS vector rates confidentiality, integrity, and availability impact as high.

Which software is identified as affected?

The listed software is Google Android and debian/linux.