CVE-2019-18660 — Sensitive Information Exposure in Kernel
Severity
4.7MEDIUMNVD
OSV9.8OSV8.8
EPSS
0.0%
top 91.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 27
Latest updateMay 24
Description
The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.0 | Impact: 3.6
Affected Packages5 packages
Also affects: Ubuntu Linux 14.04, 16.04, 18.04, 19.04, 19.10, Enterprise Linux 6.0, 7.0, 8.0, Fedora 30, 31
Patches
🔴Vulnerability Details
11OSV▶
linux, linux-aws, linux-aws-5.0, linux-azure, linux-gcp, linux-gke-5.0, linux-kvm, linux-oem-osp1, linux-oracle, linux-oracle-5.0, linux-raspi2 vulnerabilities↗2020-01-07