CVE-2019-3016: Race Condition
A flaw was found in the way Linux kernel's KVM hypervisor handled deferred TLB flush requests from guest. A race condition may occur between guest issuing a deferred TLB flush request to KVM and KVM handling and acknowledging it. This may result in invalid address translations from TLB being used to access guest memory, leading to potential information leakage issue.
A guest user/process may use this flaw to access guest memory locations which it should not have access to.
Upstream patches: ----------------- -> https://git.kernel.org/linus/a6bd811f1209fe1c64c9f6fd578101d6436c6b6e -> https://git.kernel.org/linus/b043138246a41064527cf019a3d51d9f015e9796 -> https://git.kernel.org/linus/917248144db5d7320655dbb41d3af0b8a0f3d589 -> https://git.kernel.org/linus/1eff70a9abd46f175defafd29bc17ad456f398a7 -> https://git.kernel.org/linus/8c6de56a42e0c657955e12b882a81ef07d1d073e -> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/?qt=grep&q=CVE-2019-3016
Other sources
A flaw was found in the way Linux kernel's KVM hypervisor handled deferred TLB flush requests from guest. A race condition may occur between the guest issuing a deferred TLB flush request to KVM, and then KVM handling and acknowledging it. This may result in invalid address translations from TLB being used to access guest memory, leading to a potential information leakage issue. An attacker may use this flaw to access guest memory locations that it should not have access to.
In a Linux KVM guest that has PV TLB enabled a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.
— Microsoft
In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.13.2.rt13.65.el8_2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.13.2.el8_2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 1eff70a9abd46f175defafd29bc17ad456f398a7 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 8c6de56a42e0c657955e12b882a81ef07d1d073e - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 917248144db5d7320655dbb41d3af0b8a0f3d589 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch a6bd811f1209fe1c64c9f6fd578101d6436c6b6e - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch b043138246a41064527cf019a3d51d9f015e9796
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-3016?
CVE-2019-3016 has a medium severity rating due to the potential for a race condition in the KVM hypervisor.
How do I fix CVE-2019-3016?
To remediate CVE-2019-3016, update to the latest kernel version as specified in the official redhat or debian documentation.
Which versions of the Linux kernel are affected by CVE-2019-3016?
CVE-2019-3016 affects Linux kernel versions 4.10 and higher, including specific builds noted by Red Hat and Debian.
What impact does CVE-2019-3016 have on system security?
CVE-2019-3016 can lead to invalid address translations, potentially compromising the system's memory integrity.
Is CVE-2019-3016 exploited in the wild?
As of the latest information, there have been no known active exploits of CVE-2019-3016 in the wild.