CVE-2019-15030
published 2019-09-13CVE-2019-15030: In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable…
PriorityP417medium4.4CVSS 3.1
AVLACLPRLUINSUCLINAL
EPSS
0.45%
37.0th percentile
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable exception. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process because of a missing arch/powerpc/kernel/process.c check.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | linux | < linux 5.2.17-1 (bookworm) | linux 5.2.17-1 (bookworm) |
| linux | linux_kernel | <= 5.2.14 | — |
| linux | linux_kernel | >= 0 < 5.2.17-1 | 5.2.17-1 |
| linux | linux_kernel | >= 0 < 5.2.17-1 | 5.2.17-1 |
| linux | linux_kernel | >= 0 < 5.2.17-1 | 5.2.17-1 |
| linux | linux_kernel | >= 0 < 5.2.17-1 | 5.2.17-1 |
| linux | linux_kernel | >= 0 < 4.4.0-164.192 | 4.4.0-164.192 |
| linux | linux_kernel | >= 0 < 4.15.0-64.73 | 4.15.0-64.73 |
| linux | linux_kernel | >= 0 < 3.13.0-173.224 | 3.13.0-173.224 |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
nvdv2.03.6LOWAV:L/AC:L/Au:N/C:P/I:N/A:P
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian4.4MEDIUM
vendor_redhat4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hjqf-7xm5-j2g8: In the Linux kernel through 5
ghsa_unreviewed·2022-05-24
CVE-2019-15030 [LOW] GHSA-hjqf-7xm5-j2g8: In the Linux kernel through 5
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable exception. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process because of a missing arch/powerpc/kernel/process.c check.
OSV
linux, linux-aws, linux-azure, linux-lts-trusty, linux-lts-xenial vulnerabilities
osv·2019-09-18·CVSS 7.8
CVE-2019-14835 [HIGH] linux, linux-aws, linux-azure, linux-lts-trusty, linux-lts-xenial vulnerabilities
linux, linux-aws, linux-azure, linux-lts-trusty, linux-lts-xenial vulnerabilities
Peter Pi discovered a buffer overflow in the virtio network backend
(vhost_net) implementation in the Linux kernel. An attacker in a guest may
be able to use this to cause a denial of service (host OS crash) or
possibly execute arbitrary code in the host OS. (CVE-2019-14835)
It was discovered that the Linux kernel on PowerPC architectures did not
properly handle Facility Unavailable exceptions in some situations. A local
attacker could use this to expose sensitive information. (CVE-2019-15030)
It was discovered that the Linux kernel on PowerPC architectures did not
properly handle exceptions on interrupts in some situations. A local
attacker could use this to expose sensitive information. (CVE-2019-15031)
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-gke-5.0, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
osv·2019-09-18·CVSS 7.8
CVE-2019-14835 [HIGH] linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-gke-5.0, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-gke-5.0, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
Peter Pi discovered a buffer overflow in the virtio network backend
(vhost_net) implementation in the Linux kernel. An attacker in a guest may
be able to use this to cause a denial of service (host OS crash) or
possibly execute arbitrary code in the host OS. (CVE-2019-14835)
It was discovered that the Linux kernel on PowerPC architectures did not
properly handle Facility Unavailable exceptions in some situations. A local
attacker could use this to expose sensitive information. (CVE-2019-15030)
It was discovered that the Linux kernel on PowerPC architectures did not
properly handle exceptions on interrupts in
OSV
CVE-2019-15030: In the Linux kernel through 5
osv·2019-09-13·CVSS 4.4
CVE-2019-15030 [MEDIUM] CVE-2019-15030: In the Linux kernel through 5
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable exception. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process because of a missing arch/powerpc/kernel/process.c check.
Kernel
powerpc/tm: Fix FP/VMX unavailable exceptions inside a transaction
kernel_security·2019-09-04
CVE-2019-15030 powerpc/tm: Fix FP/VMX unavailable exceptions inside a transaction
powerpc/tm: Fix FP/VMX unavailable exceptions inside a transaction
When we take an FP unavailable exception in a transaction we have to
account for the hardware FP TM checkpointed registers being
incorrect. In this case for this process we know the current and
checkpointed FP registers must be the same (since FP wasn't used
inside the transaction) hence in the thread_struct we copy the current
FP registers to the checkpointed ones.
This copy is done in tm_reclaim_thread(). We use thread->ckpt_regs.msr
to determine if FP was on when in userspace. thread->ckpt_regs.msr
represents the state of the MSR when exiting userspace. This is setup
by check_if_tm_restore_required().
Unfortunatley there is an optimisation in giveup_all() which returns
early if tsk->thread.regs->msr (via local variabl
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-09-18·CVSS 7.8
CVE-2019-14835 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Peter Pi discovered a buffer overflow in the virtio network backend
(vhost_net) implementation in the Linux kernel. An attacker in a guest may
be able to use this to cause a denial of service (host OS crash) or
possibly execute arbitrary code in the host OS. (CVE-2019-14835)
It was discovered that the Linux kernel on PowerPC architectures did not
properly handle Facility Unavailable exceptions in some situations. A local
attacker could use this to expose sensitive information. (CVE-2019-15030)
It was discovered that the Linux kernel on PowerPC architectures did not
properly handle exceptions on interrupts in some situations. A local
attacker could use this to expose sensitive informatio
Red Hat
kernel: powerpc: local user can read vector registers of other users' processes via a Facility Unavailable exception
vendor_redhat·2019-09-06·CVSS 4.4
CVE-2019-15030 [MEDIUM] CWE-20 kernel: powerpc: local user can read vector registers of other users' processes via a Facility Unavailable exception
kernel: powerpc: local user can read vector registers of other users' processes via a Facility Unavailable exception
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable exception. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process because of a missing arch/powerpc/kernel/process.c check.
A flaw in the Linux kernel on the PowerPC platform, was found where a local user can read vector registers of other user processes (via a Facility Unavailable exception). An attacker must start a
Debian
CVE-2019-15030: linux - In the Linux kernel through 5.2.14 on the powerpc platform, a local user can rea...
vendor_debian·2019·CVSS 4.4
CVE-2019-15030 [MEDIUM] CVE-2019-15030: linux - In the Linux kernel through 5.2.14 on the powerpc platform, a local user can rea...
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable exception. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process because of a missing arch/powerpc/kernel/process.c check.
Scope: local
bookworm: resolved (fixed in 5.2.17-1)
bullseye: resolved (fixed in 5.2.17-1)
forky: resolved (fixed in 5.2.17-1)
sid: resolved (fixed in 5.2.17-1)
trixie: resolved (fixed in 5.2.17-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-15030 kernel: powerpc: local user can read vector registers of other users' processes via a Facility Unavailable exception [fedora-all]
bugzilla·2019-10-07·CVSS 4.4
CVE-2019-15030 [MEDIUM] CVE-2019-15030 kernel: powerpc: local user can read vector registers of other users' processes via a Facility Unavailable exception [fedora-all]
CVE-2019-15030 kernel: powerpc: local user can read vector registers of other users' processes via a Facility Unavailable exception [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg co
Bugzilla
CVE-2019-15030 kernel: powerpc: local user can read vector registers of other users' processes via a Facility Unavailable exception
bugzilla·2019-10-07·CVSS 4.4
CVE-2019-15030 [MEDIUM] CVE-2019-15030 kernel: powerpc: local user can read vector registers of other users' processes via a Facility Unavailable exception
CVE-2019-15030 kernel: powerpc: local user can read vector registers of other users' processes via a Facility Unavailable exception
In the Linux kernels through 5.2.14 on the powerpc platform, a local user can read vector registers of other users processes via a Facility Unavailable exception (in the way the Linux kernel save and restore the FPU registers during task switch).
To exploit the vulnerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers, however, this user cannot predict when it happens (if switch task doesn't happen exactly when FPU operation, then no leakage).
At some point, the vector registers will be corrupted with the values from a different local Linux process because of a missed check i
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.htmlhttp://www.openwall.com/lists/oss-security/2019/09/10/3https://access.redhat.com/errata/RHSA-2020:0740https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8205d5d98ef7f155de211f5e2eb6ca03d95a5a60https://security.netapp.com/advisory/ntap-20191004-0001/https://usn.ubuntu.com/4135-1/https://usn.ubuntu.com/4135-2/http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.htmlhttp://www.openwall.com/lists/oss-security/2019/09/10/3https://access.redhat.com/errata/RHSA-2020:0740https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8205d5d98ef7f155de211f5e2eb6ca03d95a5a60https://security.netapp.com/advisory/ntap-20191004-0001/https://usn.ubuntu.com/4135-1/https://usn.ubuntu.com/4135-2/
2019-09-13
Published