CVE-2019-14514

An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a /system/bin/systemd binary that is run with root privileges on startup (this is unrelated to Red Hat's systemd init program, and is a closed-source proprietary tool that seems to be developed by Microvirt). This program opens TCP port 21509, presumably to receive installation-related commands from the host OS. Because everything after the installer:uninstall command is concatenated directly into a system() call, it is possible to execute arbitrary commands by supplying shell metacharacters.

CVSS v3 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://github.com/seqred-s-a/cve-2019-14514	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:microvirt:memu:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-02-11 12:15

Updated : 2023-12-10 13:13

NVD link : CVE-2019-14514

Mitre link : CVE-2019-14514

CVE.ORG link : CVE-2019-14514

JSON object : View

Products Affected

microvirt

memu

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2019-14514", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2020-02-11T12:15:20.320", "references": [{"url": "https://github.com/seqred-s-a/cve-2019-14514", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a /system/bin/systemd binary that is run with root privileges on startup (this is unrelated to Red Hat's systemd init program, and is a closed-source proprietary tool that seems to be developed by Microvirt). This program opens TCP port 21509, presumably to receive installation-related commands from the host OS. Because everything after the installer:uninstall command is concatenated directly into a system() call, it is possible to execute arbitrary commands by supplying shell metacharacters."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Microvirt MEmu todas las versiones anteriores a 7.0.2. Un sistema operativo Android invitado dentro del emulador MEmu contiene un binario /system/bin/systemd que es ejecutado con privilegios de root en el inicio (esto no est\u00e1 relacionado con el programa de inicio systemd de Red Hat, y es una herramienta patentada de c\u00f3digo cerrado que parece estar desarrollada por Microvirt). Este programa abre el puerto TCP 21509, presuntamente para recibir comandos relacionados con la instalaci\u00f3n del Sistema Operativo host. Debido a que todo despu\u00e9s del comando installer:uninstall es concatenado directamente en una llamada system(), es posible ejecutar comandos arbitrarios mediante el suministro de metacaracteres de shell."}], "lastModified": "2020-02-13T14:16:58.803", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microvirt:memu:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD11261D-929B-4132-93DC-CC902C1E39F4", "versionEndExcluding": "7.0.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}