CVE-2019-11085: Input Validation
A flaw was found in the Linux kernel's implementation of GVT-g which allowed an attacker with access to a 'passed through' Intel i915 graphics card to possibly access resources allocated to other virtual machines, crash the host, or possibly corrupt memory leading to privilege escalation.
Other sources
A flaw was found in the Linux kernels implementation of i1915 kvm passthrough. Systems configured with "Intel i915 graphics cards" passthrough for kvm guests suffer from a flaw in the kernel may allow a KVM guest to be able to crash the system or potentially enable priviledge escalation on the host.
Upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/gpu/drm/i915/gvt/kvmgt.c?id=51b00d8509dc69c98740da2ad07308b630d3eb7d
— Red Hat
Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-957.27.2.rt56.940.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-957.27.2.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-693.64.1.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-862.48.1.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-80.7.1.rt9.153.el8_0 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-80.7.1.el8_0 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 1:3.10.0-693.64.1.rt56.662.el6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.0 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 6.12.111-1Fixed in 7.2.9-1 - Upgrade
Upgrade
Linux kernel GVT-g/i915to a version that resolves this vulnerability.Fixed in 5.0Patch 51b00d8509dc69c98740da2ad07308b630d3eb7d
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-11085?
CVE-2019-11085 has been classified as a high severity vulnerability due to its potential for privilege escalation and impact on virtual machine resources.
How do I fix CVE-2019-11085?
To mitigate CVE-2019-11085, upgrade to the recommended kernel versions provided by your distribution, such as 0:3.10.0-957.27.2.rt56.940.el7 or newer.
Who is affected by CVE-2019-11085?
CVE-2019-11085 affects users of the Linux kernel with access to a 'passed through' Intel i915 graphics card.
What impacts can arise from CVE-2019-11085?
Exploiting CVE-2019-11085 could allow an attacker to access other virtual machines' resources, crash the host, or corrupt memory.
What versions of the Linux kernel are vulnerable to CVE-2019-11085?
Vulnerable versions of the Linux kernel include those prior to the patched versions like 0:3.10.0-957.27.2.rt56.940.el7 and others listed by the Linux distribution.