CVE-2019-15031: Infoleak
First published: Fri Sep 13 2019(Updated: )
A flaw in the Linux kernel on the PowerPC platform, was found where a local user can read vector registers of other user processes (during a hardware interrupt). An attacker must start a transaction when the FPU operation begins or there is no leakage. Vector registers will become corrupted with values from the different local Linux processes, because of the missing check inside arch/powerpc/kernel/process.c. The highest threat from this vulnerability is confidentiality of data and availability of the system.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-alt | <0:4.14.0-115.19.1.el7a | 0:4.14.0-115.19.1.el7a |
| redhat/kernel | <0:4.18.0-147.8.1.el8_1 | 0:4.18.0-147.8.1.el8_1 |
| Linux Linux kernel | <=5.2.14 | |
| Canonical Ubuntu Linux | =12.04 | |
| Canonical Ubuntu Linux | =14.04 | |
| Canonical Ubuntu Linux | =16.04 | |
| Canonical Ubuntu Linux | =18.04 | |
| Canonical Ubuntu Linux | =19.04 | |
| openSUSE Leap | =15.0 | |
| openSUSE Leap | =15.1 | |
| Redhat Enterprise Linux | =7.0 | |
| Redhat Enterprise Linux | =8.0 | |
| debian/linux | 5.10.223-1 6.1.106-3 6.1.99-1 6.10.9-1 |
Remedy
When applicable rely on FPU emulation (for example by rebuilding the critical services code) instead of the hardware FPU.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2019-15031 https://nvd.nist.gov/vuln/detail/CVE-2019-15031
- https://bugzilla.redhat.com/show_bug.cgi?id=1760063
- https://access.redhat.com/errata/RHSA-2020:1493
- https://access.redhat.com/errata/RHSA-2020:1372
- https://access.redhat.com/security/cve/cve-2019-15031
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html
- http://www.openwall.com/lists/oss-security/2019/09/10/4
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a8318c13e79badb92bc6640704a64cc022a6eb97
- https://security.netapp.com/advisory/ntap-20191004-0001/
- https://usn.ubuntu.com/4135-1/
- https://usn.ubuntu.com/4135-2/
- https://launchpad.net/bugs/cve/CVE-2019-15031
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1760064
- https://git.kernel.org/linus/a8318c13e79badb92bc6640704a64cc022a6eb97
- https://security-tracker.debian.org/tracker/CVE-2019-15031
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15031
- https://nvd.nist.gov/vuln/detail/CVE-2019-15031
- https://ubuntu.com/security/CVE-2019-15031
- collector/redhat-cve
- collector/nvd-index
- agent/type
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-15031
- agent/author
- agent/severity
- agent/weakness
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- agent/remedy
- agent/references
- agent/event
- agent/description
- agent/tags
- agent/first-publish-date
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/trending
- package-manager/redhat
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/5.2.14
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/12.04
- version/canonical ubuntu linux/14.04
- version/canonical ubuntu linux/16.04
- version/canonical ubuntu linux/18.04
- version/canonical ubuntu linux/19.04
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/15.0
- version/opensuse leap/15.1
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/7.0
- version/redhat enterprise linux/8.0
- package-manager/debian