CVE-2019-5489: Infoleak
A new software page cache side channel attack scenario was discovered in operating systems that implement the very common 'page cache' caching mechanism. A page cache stores memory pages of running programs and/or libraries in use on a system to improve performance.
A malicious user/process could use 'in memory' page-cache knowledge to infer access timings to shared memory and gain knowledge which can be used to :
- Reduce effectiveness of cryptographic strength by monitoring algorithmic behaviour. - Infer access patterns of memory to determine code paths taken (ie, observe process execution patterns) - Exfiltrate data to a blinded attacker through page-granularity access times as a side-channel.
Upstream patch: ---------------- -> https://git.kernel.org/linus/574823bfab82d9d8fa47f422778043fbb4b4f50e
References: ----------- -> https://arxiv.org/abs/1901.01161 -> https://www.openwall.com/lists/oss-security/2019/01/07/1
Other sources
A new software page cache side channel attack scenario was discovered in operating systems that implement the very common 'page cache' caching mechanism. A malicious user/process could use 'in memory' page-cache knowledge to infer access timings to shared memory and gain knowledge which can be used to reduce effectiveness of cryptographic strength by monitoring algorithmic behavior, infer access patterns of memory to determine code paths taken, and exfiltrate data to a blinded attacker through page-granularity access times as a side-channel.
The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-5489?
CVE-2019-5489 refers to a vulnerability discovered in the Linux kernel through version 4.19.13 that allows local attackers to infer shared memory access timings through a software page cache side channel attack.
What is the severity of CVE-2019-5489?
The severity of CVE-2019-5489 is rated as high with a CVSS score of 7.1.
Which operating systems are affected by CVE-2019-5489?
The Linux operating systems implementing the 'page cache' caching mechanism and using certain versions of the kernel are affected by this vulnerability.
How can a malicious user/process exploit CVE-2019-5489?
A malicious user/process can exploit CVE-2019-5489 by using in-memory page-cache knowledge to infer access timings to shared memory and gain sensitive information.
Where can I find more information about CVE-2019-5489?
You can find more information about CVE-2019-5489 at the following references: [Link 1](https://security-tracker.debian.org/tracker/CVE-2019-5489), [Link 2](https://git.kernel.org/linus/574823bfab82d9d8fa47f422778043fbb4b4f50e), [Link 3](https://arxiv.org/abs/1901.01161)