Medium severity · published Jul 23, 2019
CVE-2019-1010221
LineageOS 16.0 and earlier is affected by: Incorrect Access Control
6.8
CVSS
0.4%
EPSS
No
On KEV
Description
LineageOS 16.0 and earlier is affected by: Incorrect Access Control. The impact is: The property checked by `adb root` can also be set in a normal adb shell session. The component is: adb shell (patches to fix this are at https://review.lineageos.org/c/LineageOS/android_system_core/+/234800, https://review.lineageos.org/c/LineageOS/android_device_lineage_sepolicy/+/234799). The attack vector is: When adb is enabled, and an attacker has physical access, `adb shell setprop service.adb.root 1` allows restarting adb as root.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Lineageos · Lineageos
through 16.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-1010221
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-1010221
Patch
https://gist.github.com/zifnab06/e31ad63596b63a95e061bfe1f49ff0a7
More from Lineageos
6.2
CVE-2017-6899
The msm_bus_dbg_update_request_write function in drivers/platform/msm/msm_bus/msm_bus_dbg.c in android_kernel_huawei_msm8916 through 2017-06-16 in LineageOS, and possibly other…