First published: Tue Apr 02 2019(Updated: )
A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister(MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Upstream patches: ----------------- -> <a href="https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?id=acff78477b9b4f26ecdf65733a4ed77fe837e9dc">https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?id=acff78477b9b4f26ecdf65733a4ed77fe837e9dc</a> -> <a href="https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?id=c73f4c998e1fd4249b9edfa39e23f4fda2b9b041">https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?id=c73f4c998e1fd4249b9edfa39e23f4fda2b9b041</a> Reference: ---------- -> <a href="https://www.openwall.com/lists/oss-security/2019/04/08/1">https://www.openwall.com/lists/oss-security/2019/04/08/1</a>
Credit: secalert@redhat.com secalert@redhat.com secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/kernel-rt | <0:4.18.0-80.11.1.rt9.156.el8_0 | 0:4.18.0-80.11.1.rt9.156.el8_0 |
redhat/kernel | <0:4.18.0-80.11.1.el8_0 | 0:4.18.0-80.11.1.el8_0 |
Linux Linux kernel | >=4.16 | |
Fedoraproject Fedora | =29 | |
Canonical Ubuntu Linux | =18.04 | |
Canonical Ubuntu Linux | =18.10 | |
Canonical Ubuntu Linux | =19.04 | |
Redhat Enterprise Linux | =8.0 | |
Redhat Enterprise Linux Eus | =8.1 | |
Redhat Enterprise Linux Eus | =8.2 | |
Redhat Enterprise Linux Eus | =8.4 | |
Redhat Enterprise Linux For Real Time | =8 | |
Redhat Enterprise Linux For Real Time For Nfv | =8 | |
Redhat Enterprise Linux For Real Time For Nfv Tus | =8.2 | |
Redhat Enterprise Linux For Real Time For Nfv Tus | =8.4 | |
Redhat Enterprise Linux For Real Time Tus | =8.2 | |
Redhat Enterprise Linux For Real Time Tus | =8.4 | |
Redhat Enterprise Linux Server Aus | =8.2 | |
Redhat Enterprise Linux Server Aus | =8.4 | |
Redhat Enterprise Linux Server Tus | =8.2 | |
Redhat Enterprise Linux Server Tus | =8.4 | |
debian/linux | 5.10.223-1 5.10.226-1 6.1.115-1 6.1.119-1 6.12.5-1 6.12.6-1 |
If qemu is installed, to prevent nested virtualization from being enabled, set "options kvm_intel nested=0" in /etc/modprobe.d/qemu-system-x86.conf
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2019-3887 is a vulnerability in the KVM hypervisor that allows an L1 guest to access the APIC register values of an L0 guest via an L2 guest, when 'virtualize x2APIC mode' is enabled.
CVE-2019-3887 has a severity score of 6.7, which is classified as high.
The affected software includes linux-aws, linux-azure, linux-gcp, linux-hwe, linux-kvm, and more.
To fix CVE-2019-3887, it is recommended to update the affected software to the specified versions that include the necessary patches.
You can find more information about CVE-2019-3887 in the provided references.