CVE-2019-19602: Buffer Overflow
fpregsstatevalid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact because of incorrect fpufpregsownerctx caching, as demonstrated by mishandling of signal-based non-cooperative preemption in Go 1.14 prereleases on amd64, aka CID-59c4bd853abc.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.4.2
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-19602.
What is the severity of CVE-2019-19602?
The severity of CVE-2019-19602 is not specified.
What is the affected software for CVE-2019-19602?
The affected software for CVE-2019-19602 includes Linux kernel versions before 5.4.2 when GCC 9 is used.
How can this vulnerability be exploited?
This vulnerability can be exploited by context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact due to incorrect fpu_fpregs_owner_ctx caching.
How can I fix the vulnerability CVE-2019-19602?
To fix the vulnerability CVE-2019-19602, you should update your Linux kernel to version 5.5 or later.