CVE-2019-14514

CRITICAL 9.8CVE-2019-14514 · Published 11/02/2020 · updated 17/06/2026

In short

CVE-2019-14514 is a CRITICAL (CVSS 9.8) vulnerability affecting memu (microvirt).
Chance of exploitation in the next 30 days (EPSS): 7.0%, higher than 94.2% of all vulnerabilities.
Fix: update to 7.0.2 or later.

Package	Affected versions	Patched versions
memu microvirt	`< 7.0.2`	`7.0.2`

Description

An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a /system/bin/systemd binary that is run with root privileges on startup (this is unrelated to Red Hat's systemd init program, and is a closed-source proprietary tool that seems to be developed by Microvirt). This program opens TCP port 21509, presumably to receive installation-related commands from the host OS. Because everything after the installer:uninstall command is concatenated directly into a system() call, it is possible to execute arbitrary commands by supplying shell metacharacters.

References

seqred-s-a/cve-2019-14514 · Exploit

More vulnerabilities in memu

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free