Description
An issue was discovered in LinuxTV xawtv before 3.107. The function dev_open() in v4l-conf.c does not perform sufficient checks to prevent an unprivileged caller of the program from opening unintended filesystem paths. This allows a local attacker with access to the v4l-conf setuid-root program to test for the existence of arbitrary files and to trigger an open on arbitrary files with mode O_RDWR. To achieve this, relative path components need to be added to the device path, as demonstrated by a v4l-conf -c /dev/../root/.bash_history command.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xawtv | 3.107-1 | — |
| Debian 13 | xawtv | 3.107-1 | — |
| Debian 12 | xawtv | 3.107-1 | — |
| Debian 8 | xawtv | 3.103-3+deb8u1 | DLA-2246-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | xawtv | No fix yet | — |
| Ubuntu 18.04 LTS | xawtv | No fix yet | — |
| Ubuntu 16.04 LTS | xawtv | 3.103-3+deb8u1build0.16.04.1 | USN-4518-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | xawtv | 3.103-6.3.1 | SUSE-SU-2020:1712-1 |
| SLES 12 SP4 | xawtv | 3.103-6.3.1 | SUSE-SU-2020:1712-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP1 | xawtv | 3.103-bp151.4.3.1 | openSUSE-SU-2020:0787-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xawtv | 3.107-2.5 | openSUSE-SU-2024:11517-1 |
| openSUSE Leap 15.1 | xawtv | 3.103-lp151.3.3.1 | openSUSE-SU-2020:0784-1 |
Advisories 6
- USN-4518-1 xawtv vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-2246-1 xawtv - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2020:0784-1 Security update for xawtv SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0787-1 Security update for xawtv SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11517-1 alevtd-3.107-2.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:1712-1 Security update for xawtv SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://git.linuxtv.org/xawtv3.git/commit/?id=31f31f9cbaee7be806cba38e0ff5431bd44b20a3
- https://git.linuxtv.org/xawtv3.git/commit/?id=36dc44e68e5886339b4a0fbe3f404fb1a4fd2292
- https://git.linuxtv.org/xawtv3.git/commit/?id=8e3feea862db68d3ca0886f46cd99fab45d2db7c
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-13696
- http://www.openwall.com/lists/oss-security/2020/06/04/6
- openSUSE-SU-2020:0784 vendor-advisory
- openSUSE-SU-2020:0787 vendor-advisory
- [debian-lts-announce] 20200612 [SECURITY] [DLA 2246-1] xawtv security update mailing-list
- USN-4518-1 vendor-advisory
- FEDORA-2020-cd5ad916e4 vendor-advisory
- FEDORA-2020-93db553bb7 vendor-advisory