CVE-2019-1010221 - LineageOS 16.0 and earlier is affected by: Incorrect Access Control

MEDIUM

LineageOS 16.0 and earlier is affected by: Incorrect Access Control

Published Jul 23, 2019

6.8

MEDIUM

CVSS 3.0

EPSS 0.37%

LineageOS 16.0 and earlier is affected by: Incorrect Access Control. The impact is: The property checked by `adb root` can also be set in a normal adb shell session. The component is: adb shell (patches to fix this are at https://review.lineageos.org/c/LineageOS/android_system_core/+/234800, https://review.lineageos.org/c/LineageOS/android_device_lineage_sepolicy/+/234799). The attack vector is: When adb is enabled, and an attacker has physical access, `adb shell setprop service.adb.root 1` allows restarting adb as root.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
16.0 and earlier	affected	-

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1963		Advisory
https://gist.github.com/zifnab06/e31ad63596b63a95e061bfe1f49ff0a7		x_refsource_MISCPatchThird Party Advisory