First published: Sat Feb 02 2019(Updated: )
An information leakage issue was found in the way Linux kernel's KVM hypervisor handled page fault exception while emulating instructions like VMXON, VMCLEAR, VMPTRLD, VMWRITE with memory address as an operand. It occurs if the operand is an mmio address, as the returned exception object holds uninitialised stack memory contents. A guest user/process could use this flaw to leak host's stack memory contents to a guest. It affects only Intel processors and only when nested virtualization is enabled. Upstream patch: --------------- -> <a href="https://git.kernel.org/linus/353c0956a618a07ba4bbe7ad00ff29fe70e8412a">https://git.kernel.org/linus/353c0956a618a07ba4bbe7ad00ff29fe70e8412a</a> Reference: ---------- -> <a href="https://www.openwall.com/lists/oss-security/2019/02/18/2">https://www.openwall.com/lists/oss-security/2019/02/18/2</a>
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/kernel-rt | <0:3.10.0-1062.rt56.1022.el7 | 0:3.10.0-1062.rt56.1022.el7 |
redhat/kernel | <0:3.10.0-1062.el7 | 0:3.10.0-1062.el7 |
redhat/kernel-rt | <0:4.18.0-147.rt24.93.el8 | 0:4.18.0-147.rt24.93.el8 |
redhat/kernel | <0:4.18.0-147.el8 | 0:4.18.0-147.el8 |
Linux Kernel | <=4.20.5 | |
Red Hat Fedora | =28 | |
Red Hat Fedora | =29 | |
SUSE Linux | =15.0 | |
Debian Linux | =8.0 | |
Ubuntu | =12.04 | |
Ubuntu | =14.04 | |
Ubuntu | =16.04 | |
Ubuntu | =18.04 | |
Ubuntu | =18.10 | |
NetApp Active IQ | ||
NetApp Element Software | ||
Red Hat Enterprise Linux | =8.0 | |
Red Hat Enterprise Linux Desktop | =7.0 | |
Red Hat Enterprise Linux Server EUS | =8.1 | |
Red Hat Enterprise Linux Server EUS | =8.2 | |
Red Hat Enterprise Linux Server EUS | =8.4 | |
Red Hat Enterprise Linux Server EUS | =8.6 | |
Red Hat Enterprise Linux for Real Time | =7 | |
Red Hat Enterprise Linux for Real Time | =8 | |
Red Hat Enterprise Linux for Real Time for NFV | =7 | |
Red Hat Enterprise Linux for Real Time for NFV | =8.2 | |
Red Hat Enterprise Linux for Real Time for NFV | =8.4 | |
Red Hat Enterprise Linux for Real Time for NFV | =8.6 | |
Red Hat Enterprise Linux for Real Time | =8.2 | |
Red Hat Enterprise Linux for Real Time | =8.4 | |
Red Hat Enterprise Linux for Real Time | =8.6 | |
Red Hat Enterprise Linux Server | =7.0 | |
Red Hat Enterprise Linux Server | =8.2 | |
Red Hat Enterprise Linux Server | =8.4 | |
Red Hat Enterprise Linux Server | =8.6 | |
Red Hat Enterprise Linux Server | =8.2 | |
Red Hat Enterprise Linux Server | =8.4 | |
Red Hat Enterprise Linux Server | =8.6 | |
Red Hat Enterprise Linux Workstation | =7.0 | |
debian/linux | 5.10.223-1 5.10.234-1 6.1.129-1 6.1.128-1 6.12.21-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
CVE-2019-7222 has been classified as a medium severity vulnerability.
To mitigate CVE-2019-7222, update your kernel to the version specified in the remedy for your Linux distribution.
CVE-2019-7222 affects various versions of the Linux kernel, specifically those up to 4.20.5.
To determine if your system is vulnerable to CVE-2019-7222, check the Linux kernel version against the affected versions.
CVE-2019-7222 impacts the Linux kernel, impacting systems running various distributions like Red Hat, Fedora, Debian, and Ubuntu.