CVE-2019-15902: Infoleak
First published: Wed Sep 04 2019(Updated: )
A backporting error was discovered in the Linux stable/longterm kernel 4.4.x through 4.4.190, 4.9.x through 4.9.190, 4.14.x through 4.14.141, 4.19.x through 4.19.69, and 5.2.x through 5.2.11. Misuse of the upstream "x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()" commit reintroduced the Spectre vulnerability that it aimed to eliminate. This occurred because the backport process depends on cherry picking specific commits, and because two (correctly ordered) code lines were swapped.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Linux kernel | >=4.4<=4.4.190 | |
| Linux Linux kernel | >=4.9<=4.9.190 | |
| Linux Linux kernel | >=4.14<=4.14.141 | |
| Linux Linux kernel | >=4.19<=4.19.69 | |
| Linux Linux kernel | >=5.2<=5.2.11 | |
| Netapp Active Iq Performance Analytics Services | ||
| NetApp Service Processor | ||
| Debian Debian Linux | =8.0 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| openSUSE Leap | =15.0 | |
| openSUSE Leap | =15.1 | |
| Netapp Baseboard Management Controller Firmware | ||
| Netapp Baseboard Management Controller | ||
| All of | ||
| Netapp Baseboard Management Controller Firmware | ||
| Netapp Baseboard Management Controller | ||
| ubuntu/linux | <4.15.0-66.75 | 4.15.0-66.75 |
| ubuntu/linux | <5.0.0-32.34 | 5.0.0-32.34 |
| ubuntu/linux | <2.6.12~ | 2.6.12~ |
| ubuntu/linux | <4.4.0-166.195 | 4.4.0-166.195 |
| ubuntu/linux-aws | <4.15.0-1052.54 | 4.15.0-1052.54 |
| ubuntu/linux-aws | <5.0.0-1019.21 | 5.0.0-1019.21 |
| ubuntu/linux-aws | <4.4.0-1056.60 | 4.4.0-1056.60 |
| ubuntu/linux-aws | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-aws | <4.4.0-1096.107 | 4.4.0-1096.107 |
| ubuntu/linux-aws-5.0 | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-aws-hwe | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-aws-hwe | <4.15.0-1052.54~16.04.1 | 4.15.0-1052.54~16.04.1 |
| ubuntu/linux-azure | <5.0.0-1023.24~18.04.1 | 5.0.0-1023.24~18.04.1 |
| ubuntu/linux-azure | <5.0.0-1023.24 | 5.0.0-1023.24 |
| ubuntu/linux-azure | <4.15.0-1061.66~14.04.1 | 4.15.0-1061.66~14.04.1 |
| ubuntu/linux-azure | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-azure | <4.15.0-1061.66 | 4.15.0-1061.66 |
| ubuntu/linux-azure-5.3 | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-azure-edge | <5.0.0-1023.24~18.04.1 | 5.0.0-1023.24~18.04.1 |
| ubuntu/linux-azure-edge | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-azure-edge | <4.15.0-1061.66 | 4.15.0-1061.66 |
| ubuntu/linux-gcp | <5.0.0-1021.21~18.04.1 | 5.0.0-1021.21~18.04.1 |
| ubuntu/linux-gcp | <5.0.0-1021.21 | 5.0.0-1021.21 |
| ubuntu/linux-gcp | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-gcp | <4.15.0-1047.50 | 4.15.0-1047.50 |
| ubuntu/linux-gcp-5.3 | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-gcp-edge | <5.0.0-1021.21~18.04.1 | 5.0.0-1021.21~18.04.1 |
| ubuntu/linux-gcp-edge | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-gke-4.15 | <4.15.0-1046.49 | 4.15.0-1046.49 |
| ubuntu/linux-gke-4.15 | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-gke-5.0 | <5.0.0-1023.23~18.04.2 | 5.0.0-1023.23~18.04.2 |
| ubuntu/linux-gke-5.0 | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-gke-5.3 | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-hwe | <5.0.0-32.34~18.04.2 | 5.0.0-32.34~18.04.2 |
| ubuntu/linux-hwe | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-hwe | <4.15.0-66.75~16.04.1 | 4.15.0-66.75~16.04.1 |
| ubuntu/linux-hwe-edge | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-hwe-edge | <4.15.0-66.75~16.04.1 | 4.15.0-66.75~16.04.1 |
| ubuntu/linux-kvm | <4.15.0-1048.48 | 4.15.0-1048.48 |
| ubuntu/linux-kvm | <5.0.0-1020.21 | 5.0.0-1020.21 |
| ubuntu/linux-kvm | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-kvm | <4.4.0-1060.67 | 4.4.0-1060.67 |
| ubuntu/linux-lts-trusty | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-lts-xenial | <4.4.0-166.195~14.04.1 | 4.4.0-166.195~14.04.1 |
| ubuntu/linux-lts-xenial | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-oem | <4.15.0-1059.68 | 4.15.0-1059.68 |
| ubuntu/linux-oem | <4.15.0-1059.68 | 4.15.0-1059.68 |
| ubuntu/linux-oem | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-oem-5.6 | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-oem-osp1 | <5.0.0-1025.28 | 5.0.0-1025.28 |
| ubuntu/linux-oem-osp1 | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-oracle | <4.15.0-1027.30 | 4.15.0-1027.30 |
| ubuntu/linux-oracle | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-oracle | <4.15.0-1027.30~16.04.1 | 4.15.0-1027.30~16.04.1 |
| ubuntu/linux-oracle-5.0 | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-oracle-5.3 | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-raspi2 | <4.15.0-1049.53 | 4.15.0-1049.53 |
| ubuntu/linux-raspi2 | <5.0.0-1020.20 | 5.0.0-1020.20 |
| ubuntu/linux-raspi2 | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-raspi2 | <4.4.0-1124.133 | 4.4.0-1124.133 |
| ubuntu/linux-raspi2-5.3 | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-snapdragon | <4.15.0-1066.73 | 4.15.0-1066.73 |
| ubuntu/linux-snapdragon | <5.0.0-1024.25 | 5.0.0-1024.25 |
| ubuntu/linux-snapdragon | <2.6.12~ | 2.6.12~ |
| ubuntu/linux-snapdragon | <4.4.0-1128.136 | 4.4.0-1128.136 |
| debian/linux | 4.19.249-2 4.19.304-1 5.10.209-2 5.10.216-1 6.1.76-1 6.1.90-1 6.7.12-1 6.8.9-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html
- https://grsecurity.net/teardown_of_a_failed_linux_lts_spectre_fix.php
- https://lists.debian.org/debian-lts-announce/2019/10/msg00000.html
- https://seclists.org/bugtraq/2019/Sep/41
- https://security.netapp.com/advisory/ntap-20191004-0001/
- https://usn.ubuntu.com/4157-1/
- https://usn.ubuntu.com/4157-2/
- https://usn.ubuntu.com/4162-1/
- https://usn.ubuntu.com/4162-2/
- https://usn.ubuntu.com/4163-1/
- https://usn.ubuntu.com/4163-2/
- https://www.debian.org/security/2019/dsa-4531
- https://launchpad.net/bugs/cve/CVE-2019-15902
- https://security-tracker.debian.org/tracker/CVE-2019-15902
- https://ubuntu.com/security/notices/USN-4157-1
- https://ubuntu.com/security/notices/USN-4162-1
- https://ubuntu.com/security/notices/USN-4163-1
- https://ubuntu.com/security/notices/USN-4157-2
- https://ubuntu.com/security/notices/USN-4162-2
- https://ubuntu.com/security/notices/USN-4163-2
- https://www.cve.org/CVERecord?id=CVE-2019-15902
- https://nvd.nist.gov/vuln/detail/CVE-2019-15902
- https://git.kernel.org/linus/local-2019-15902-break
- https://git.kernel.org/linus/local-2019-15902-fix
- https://ubuntu.com/security/CVE-2019-15902
Parent vulnerabilities
(Appears in the following advisories)
- collector/nvd-index
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/references
- agent/author
- agent/remedy
- agent/weakness
- agent/severity
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/description
- agent/tags
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/4.4
- version/linux linux kernel/4.4.190
- version/linux linux kernel/4.9
- version/linux linux kernel/4.9.190
- version/linux linux kernel/4.14
- version/linux linux kernel/4.14.141
- version/linux linux kernel/4.19
- version/linux linux kernel/4.19.69
- version/linux linux kernel/5.2
- version/linux linux kernel/5.2.11
- vendor/netapp
- canonical/netapp active iq performance analytics services
- canonical/netapp service processor
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/15.0
- version/opensuse leap/15.1
- canonical/netapp baseboard management controller firmware
- canonical/netapp baseboard management controller
- package-manager/debian
- package-manager/ubuntu