CVE-2019-9456: Medium severity Google Android vulnerability

Q: What is the severity of CVE-2019-9456?

CVE-2019-9456 is considered a high severity vulnerability due to its potential for local escalation of privilege.

Q: How do I fix CVE-2019-9456?

To fix CVE-2019-9456, update the affected software to the latest security patches provided by Google and openSUSE.

Q: Which systems are affected by CVE-2019-9456?

CVE-2019-9456 affects certain versions of Google Android and openSUSE Leap 15.0 and 15.1.

Q: Is user interaction required to exploit CVE-2019-9456?

No, user interaction is not needed for the exploitation of CVE-2019-9456.

Q: What type of attack does CVE-2019-9456 enable?

CVE-2019-9456 enables a local escalation of privilege attack due to an out-of-bounds write in the Android kernel.

Published Sep 6, 2019

Updated

In the Android kernel in Pixel C USB monitor driver there is a possible OOB write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected Software

35 affected componentsFixes available

Google Android

openSUSE Leap=15.0

openSUSE Leap=15.1

ubuntu/linux-aws<4.4.0-1022.22

4.4.0-1022.22

ubuntu/linux-lts-xenial<4.4.0-127.153~14.04.1

4.4.0-127.153~14.04.1

ubuntu/linux*

ubuntu/linux<4.4.0-127.153

4.4.0-127.153

ubuntu/linux-aws<4.4.0-1060.69

4.4.0-1060.69

ubuntu/linux-azure<4.15.0-1013.13~16.04.2

4.15.0-1013.13~16.04.2

ubuntu/linux-gcp<4.15.0-1014.14~16.04.1

4.15.0-1014.14~16.04.1

ubuntu/linux-hwe<4.15.0-24.26~16.04.1

4.15.0-24.26~16.04.1

ubuntu/linux-kvm<4.4.0-1026.31

4.4.0-1026.31

ubuntu/linux-raspi2<4.4.0-1090.98

4.4.0-1090.98

ubuntu/linux-snapdragon<4.4.0-1093.98

4.4.0-1093.98

ubuntu/linux-hwe-edge*

ubuntu/linux-fips<4.4.0-1008.10

4.4.0-1008.10

ubuntu/linux-snapdragon<4.15.0-1053.57

4.15.0-1053.57

ubuntu/linux-aws-5.0*

ubuntu/linux-azure*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-edge*

ubuntu/linux-oracle-5.0*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15*

ubuntu/linux-gke*

ubuntu/linux-raspi2*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-azure-6.11*

ubuntu/linux-gcp-6.11*

ubuntu/linux-hwe-6.11*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-raspi-realtime*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1022.22
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-127.153~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-127.153
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1060.69
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1013.13~16.04.2
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1014.14~16.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-24.26~16.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.4.0-1026.31
Upgrade
Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.
Fixed in 4.4.0-1090.98
Upgrade
Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.
Fixed in 4.4.0-1093.98
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.4.0-1008.10
Upgrade
Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.
Fixed in 4.15.0-1053.57

Event History

Sep 6, 2019

CVE Published

via MITRE·09:49 PM

Data Sourced

via MITRE·09:49 PM

DescriptionWeakness

Data Sourced

via OSV·10:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-9456?

CVE-2019-9456 is considered a high severity vulnerability due to its potential for local escalation of privilege.

How do I fix CVE-2019-9456?