First published: Sat Feb 02 2019(Updated: )
An information leakage issue was found in the way Linux kernel's KVM hypervisor handled page fault exception while emulating instructions like VMXON, VMCLEAR, VMPTRLD, VMWRITE with memory address as an operand. It occurs if the operand is an mmio address, as the returned exception object holds uninitialised stack memory contents. A guest user/process could use this flaw to leak host's stack memory contents to a guest. It affects only Intel processors and only when nested virtualization is enabled. Upstream patch: --------------- -> <a href="https://git.kernel.org/linus/353c0956a618a07ba4bbe7ad00ff29fe70e8412a">https://git.kernel.org/linus/353c0956a618a07ba4bbe7ad00ff29fe70e8412a</a> Reference: ---------- -> <a href="https://www.openwall.com/lists/oss-security/2019/02/18/2">https://www.openwall.com/lists/oss-security/2019/02/18/2</a>
Credit: cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/kernel-rt | <0:3.10.0-1062.rt56.1022.el7 | 0:3.10.0-1062.rt56.1022.el7 |
redhat/kernel | <0:3.10.0-1062.el7 | 0:3.10.0-1062.el7 |
redhat/kernel-rt | <0:4.18.0-147.rt24.93.el8 | 0:4.18.0-147.rt24.93.el8 |
redhat/kernel | <0:4.18.0-147.el8 | 0:4.18.0-147.el8 |
Linux Linux kernel | <=4.20.5 | |
Fedoraproject Fedora | =28 | |
Fedoraproject Fedora | =29 | |
openSUSE Leap | =15.0 | |
Debian Debian Linux | =8.0 | |
Canonical Ubuntu Linux | =12.04 | |
Canonical Ubuntu Linux | =14.04 | |
Canonical Ubuntu Linux | =16.04 | |
Canonical Ubuntu Linux | =18.04 | |
Canonical Ubuntu Linux | =18.10 | |
Netapp Active Iq Performance Analytics Services | ||
Netapp Element Software Management Node | ||
Redhat Enterprise Linux | =8.0 | |
Redhat Enterprise Linux Desktop | =7.0 | |
Redhat Enterprise Linux Eus | =8.1 | |
Redhat Enterprise Linux Eus | =8.2 | |
Redhat Enterprise Linux Eus | =8.4 | |
Redhat Enterprise Linux Eus | =8.6 | |
Redhat Enterprise Linux For Real Time | =7 | |
Redhat Enterprise Linux For Real Time | =8 | |
Redhat Enterprise Linux For Real Time For Nfv | =7 | |
Redhat Enterprise Linux For Real Time For Nfv Tus | =8.2 | |
Redhat Enterprise Linux For Real Time For Nfv Tus | =8.4 | |
Redhat Enterprise Linux For Real Time For Nfv Tus | =8.6 | |
Redhat Enterprise Linux For Real Time Tus | =8.2 | |
Redhat Enterprise Linux For Real Time Tus | =8.4 | |
Redhat Enterprise Linux For Real Time Tus | =8.6 | |
Redhat Enterprise Linux Server | =7.0 | |
Redhat Enterprise Linux Server Aus | =8.2 | |
Redhat Enterprise Linux Server Aus | =8.4 | |
Redhat Enterprise Linux Server Aus | =8.6 | |
Redhat Enterprise Linux Server Tus | =8.2 | |
Redhat Enterprise Linux Server Tus | =8.4 | |
Redhat Enterprise Linux Server Tus | =8.6 | |
Redhat Enterprise Linux Workstation | =7.0 | |
debian/linux | 5.10.223-1 5.10.226-1 6.1.115-1 6.1.112-1 6.11.5-1 6.11.7-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)