Microvirt MEmu up to 7.0.1 /system/bin/systemd system Shell Metacharacter os command injection

Summaryinfo

A vulnerability labeled as critical has been found in Microvirt MEmu up to 7.0.1. This affects the function system of the file /system/bin/systemd. Executing a manipulation as part of Shell Metacharacter can lead to os command injection. This vulnerability is handled as CVE-2019-14514. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Microvirt MEmu up to 7.0.1 (Virtualization Software). It has been declared as very critical. This vulnerability affects the function system of the file /system/bin/systemd. The manipulation as part of a Shell Metacharacter leads to a os command injection vulnerability. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a /system/bin/systemd binary that is run with root privileges on startup (this is unrelated to Red Hat's systemd init program, and is a closed-source proprietary tool that seems to be developed by Microvirt). This program opens TCP port 21509, presumably to receive installation-related commands from the host OS. Because everything after the installer:uninstall command is concatenated directly into a system() call, it is possible to execute arbitrary commands by supplying shell metacharacters.

The weakness was released 02/11/2020. This vulnerability was named CVE-2019-14514 since 08/01/2019. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 02/11/2020). This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

Upgrading to version 7.0.2 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Virtualization Software

Vendor

• Microvirt

Name

• MEmu

Version

• 7.0.0
• 7.0.1

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion