CVE-2019-7221: Use After Free

Published Feb 2, 2019
·
Updated

A use after free issue was found in the way Linux kernel's KVM hypervisor emulates a preemption timer for L2 guest when nested(=1) virtualization is enabled. This high resolution timer(hrtimer) runs when L2 guest is active. After VM exit, in syncvmcs12() timer object is stopped. The use-after-free occurs if the timer object is free'd before calling syncvmcs12() routine.

A guest user/process could use this flaw to crash the host kernel resulting in DoS OR potentially gain privileged access to a system.

It affects only Intel processors and only when nested virtualization is enabled.

Upstream patch: --------------- -> https://git.kernel.org/linus/ecec76885bcfe3294685dc363fd1273df0d5d65f

Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/02/18/2

Other sources

The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.

MITRE

Affected Software

20 affected componentsFixes available
Linux Linux kernel<=4.20.5
openSUSE Leap=15.0
Fedoraproject Fedora=28
Fedoraproject Fedora=29
Debian Debian Linux=8.0
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=18.10
NetApp Active Iq Performance Analytics Services
NetApp Element Software Management Node
redhat OpenShift Container Platform=3.11
redhat Enterprise Linux=7.0
redhat Enterprise Linux Desktop=7.0
redhat Enterprise Linux Server=7.0
redhat Enterprise Linux Server Aus=7.6
redhat Enterprise Linux Server Eus=7.6
redhat Enterprise Linux Server Tus=7.6
redhat Enterprise Linux Workstation=7.0
debian/linux
5.10.223-15.10.262-16.1.176-16.1.180-16.12.94-16.12.101-17.1.7-17.1.8-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.7-1Fixed in 7.1.8-1

Event History

Feb 2, 2019
Data Sourced
via Red Hat·05:20 AM
DescriptionSeverityAffected Software
Mar 17, 2019
CVE Published
via MITRE·06:26 PM
Data Sourced
via MITRE·06:26 PM
Description
Mar 21, 2019
Data Sourced
via NVD·04:01 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jun 23, 2026
Data Sourced
via Launchpad·11:14 AM
Description
Jul 4, 2026
Data Sourced
via Ubuntu·11:29 AM
RemedyDescriptionSeverityAffected Software
Aug 12, 2026
Data Sourced
via Debian·11:04 AM
DescriptionAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2019-7221?

CVE-2019-7221 has been rated as a high severity vulnerability due to its potential impact on the Linux kernel's KVM hypervisor.

2

How do I fix CVE-2019-7221?

To resolve CVE-2019-7221, upgrade to a fixed kernel version such as 5.10.223-1 or later.

3

Which software versions are affected by CVE-2019-7221?

CVE-2019-7221 affects Linux kernel versions up to and including 4.20.5 among various distributions like openSUSE, Fedora, and Ubuntu.

4

What systems are impacted by CVE-2019-7221?

The systems impacted by CVE-2019-7221 include various Linux distributions and versions that are utilizing the Linux kernel's KVM hypervisor.

5

What is the exploit type of CVE-2019-7221?

CVE-2019-7221 is classified as a use-after-free vulnerability in the KVM hypervisor.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203