CVE-2019-3887: Medium severity Linux Linux kernel vulnerability
A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister(MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled.
A guest could use this flaw to potentially crash the host kernel resulting in DoS issue.
Upstream patches: ----------------- -> https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?id=acff78477b9b4f26ecdf65733a4ed77fe837e9dc -> https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?id=c73f4c998e1fd4249b9edfa39e23f4fda2b9b041
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/04/08/1
Other sources
A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Register (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue.
A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that L1 guest could access L0's APIC register values via L2 guest when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue.
— Microsoft
A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-80.11.1.rt9.156.el8_0 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-80.11.1.el8_0 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Configuration
If qemu is installed, prevent nested virtualization from being enabled by setting `options kvm_intel nested=0` in `/etc/modprobe.d/qemu-system-x86.conf`.
Linux KVM Intel module (kvm_intel) nested = 0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-3887?
CVE-2019-3887 is a vulnerability in the KVM hypervisor that allows an L1 guest to access the APIC register values of an L0 guest via an L2 guest, when 'virtualize x2APIC mode' is enabled.
What is the severity of CVE-2019-3887?
CVE-2019-3887 has a severity score of 6.7, which is classified as high.
What software is affected by CVE-2019-3887?
The affected software includes linux-aws, linux-azure, linux-gcp, linux-hwe, linux-kvm, and more.
How can I fix CVE-2019-3887?
To fix CVE-2019-3887, it is recommended to update the affected software to the specified versions that include the necessary patches.
Where can I find more information about CVE-2019-3887?
You can find more information about CVE-2019-3887 in the provided references.