CVE-2019-15030: Input Validation

In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable exception. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process because of a missing arch/powerpc/kernel/process.c check.

In the Linux kernels through 5.2.14 on the powerpc platform, a local user can read vector registers of other users processes via a Facility Unavailable exception (in the way the Linux kernel save and restore the FPU registers during task switch). To exploit the vulnerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers, however, this user cannot predict when it happens (if switch task doesn't happen exactly when FPU operation, then no leakage). At some point, the vector registers will be corrupted with the values from a different local Linux process because of a missed check in arch/powerpc/kernel/process.c. The only mitigation for this issue: not using FPU completely (then can use emulation instead).

References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8205d5d98ef7f155de211f5e2eb6ca03d95a5a60

— Red Hat