CVE-2019-3016
published 2020-01-31CVE-2019-3016: In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This…
PriorityP421medium4.7CVSS 3.1
AVLACHPRLUINSUCHINAN
EPSS
0.62%
46.2th percentile
In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.4.19-1 (bookworm) | linux 5.4.19-1 (bookworm) |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.4.19-1 | 5.4.19-1 |
| linux | linux_kernel | >= 0 < 5.4.19-1 | 5.4.19-1 |
| linux | linux_kernel | >= 0 < 5.4.19-1 | 5.4.19-1 |
| linux | linux_kernel | >= 0 < 5.4.19-1 | 5.4.19-1 |
| linux | linux_kernel | >= 0 < 4.4.0-177.207 | 4.4.0-177.207 |
| linux | linux_kernel | >= 0 < 4.15.0-96.97 | 4.15.0-96.97 |
| linux | linux_kernel | >= 4.16 | — |
| msrc | azl3_kernel_6.6.29.1-4_on_azure_linux_3.0 | — | — |
| msrc | azl3_kernel_6.6.92.2-1_on_azure_linux_3.0 | — | — |
| msrc | bpftool-5.15.32.1-3.cm2.aarch64.rpm | — | — |
| msrc | bpftool-5.15.32.1-3.cm2.x86_64.rpm | — | — |
| msrc | bpftool-6.6.29.1-4.azl3.aarch64.rpm | — | — |
| msrc | bpftool-6.6.29.1-4.azl3.x86_64.rpm | — | — |
| msrc | cbl2_kernel_5.10.78.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_kernel_5.10.60.1-1_on_cbl_mariner_1.0 | — | — |
| msrc | kernel-5.10.60.1-1.cm1.aarch64.rpm | — | — |
| msrc | kernel-5.10.60.1-1.cm1.x86_64.rpm | — | — |
| msrc | kernel-5.15.32.1-3.cm2.aarch64.rpm | — | — |
| msrc | kernel-5.15.32.1-3.cm2.x86_64.rpm | — | — |
| msrc | kernel-6.6.29.1-4.azl3.aarch64.rpm | — | — |
| msrc | kernel-6.6.29.1-4.azl3.x86_64.rpm | — | — |
| msrc | kernel-debuginfo-5.10.60.1-1.cm1.aarch64.rpm | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.01.9LOWAV:L/AC:M/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian6.2MEDIUM
vendor_redhat6.2MEDIUM
vendor_msrc4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Kernel Live Patch Security Notice
vendor_ubuntu·2020-04-09·CVSS 6.2
CVE-2013-1798 [MEDIUM] Kernel Live Patch Security Notice
Title: Kernel Live Patch Security Notice
Summary: Several security issues were fixed in the kernel.
Andrew Honig reported a flaw in the way KVM (Kernel-based Virtual
Machine) emulated the IOAPIC. A privileged guest user could exploit
this flaw to read host memory or cause a denial of service (crash
the host). (CVE-2013-1798)
It was discovered that the KVM implementation in the Linux kernel,
when paravirtual TLB flushes are enabled in guests, the hypervisor in
some situations could miss deferred TLB flushes or otherwise mishandle
them. An attacker in a guest VM could use this to expose sensitive
information (read memory from another guest VM). (CVE-2019-3016)
Al Viro discovered that the vfs layer in the Linux kernel contained
a use- after-free vulnerability. A local attacker could use t
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-03-25·CVSS 4.6
CVE-2019-18809 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the KVM implementation in the Linux kernel, when
paravirtual TLB flushes are enabled in guests, the hypervisor in some
situations could miss deferred TLB flushes or otherwise mishandle them. An
attacker in a guest VM could use this to expose sensitive information (read
memory from another guest VM). (CVE-2019-3016)
Paulo Bonzini discovered that the KVM hypervisor implementation in the
Linux kernel could improperly let a nested (level 2) guest access the
resources of a parent (level 1) guest in certain situations. An attacker
could use this to expose sensitive information. (CVE-2020-2732)
It was discovered that the Afatech AF9005 DVB-T USB device driver in the
Linu
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-03-25·CVSS 7.5
CVE-2019-19053 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the KVM implementation in the Linux kernel, when
paravirtual TLB flushes are enabled in guests, the hypervisor in some
situations could miss deferred TLB flushes or otherwise mishandle them. An
attacker in a guest VM could use this to expose sensitive information (read
memory from another guest VM). (CVE-2019-3016)
Paulo Bonzini discovered that the KVM hypervisor implementation in the
Linux kernel could improperly let a nested (level 2) guest access the
resources of a parent (level 1) guest in certain situations. An attacker
could use this to expose sensitive information. (CVE-2020-2732)
It was discovered that the RPMSG character device interface in the Linux
kern
Red Hat
kernel: kvm: Information leak within a KVM guest
vendor_redhat·2020-01-30·CVSS 6.2
CVE-2019-3016 [MEDIUM] CWE-366 kernel: kvm: Information leak within a KVM guest
kernel: kvm: Information leak within a KVM guest
In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.
A flaw was found in the way Linux kernel's KVM hypervisor handled deferred TLB flush requests from guest. A race condition may occur between the guest issuing a deferred TLB flush request to KVM, and then KVM handling and acknowledging it. This may result in invalid address translations from TLB being used to access guest memory, leading to a potential information leakage issue. An attacker may use this fl
Microsoft
In a Linux KVM guest that has PV TLB enabled a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux
vendor_msrc·2020-01-14·CVSS 4.7
CVE-2019-3016 [MEDIUM] CWE-362 In a Linux KVM guest that has PV TLB enabled a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux
In a Linux KVM guest that has PV TLB enabled a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publis
Debian
CVE-2019-3016: linux - In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may ...
vendor_debian·2019·CVSS 6.2
CVE-2019-3016 [MEDIUM] CVE-2019-3016: linux - In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may ...
In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.
Scope: local
bookworm: resolved (fixed in 5.4.19-1)
bullseye: resolved (fixed in 5.4.19-1)
forky: resolved (fixed in 5.4.19-1)
sid: resolved (fixed in 5.4.19-1)
trixie: resolved (fixed in 5.4.19-1)
GHSA
GHSA-g7mw-cr59-r458: In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same gues
ghsa_unreviewed·2022-05-24
CVE-2019-3016 [LOW] GHSA-g7mw-cr59-r458: In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same gues
In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.
OSV
Kernel Live Patch Security Notice
osv·2020-04-09·CVSS 6.2
CVE-2013-1798 [MEDIUM] Kernel Live Patch Security Notice
Kernel Live Patch Security Notice
Andrew Honig reported a flaw in the way KVM (Kernel-based Virtual
Machine) emulated the IOAPIC. A privileged guest user could exploit
this flaw to read host memory or cause a denial of service (crash
the host). (CVE-2013-1798)
It was discovered that the KVM implementation in the Linux kernel,
when paravirtual TLB flushes are enabled in guests, the hypervisor in
some situations could miss deferred TLB flushes or otherwise mishandle
them. An attacker in a guest VM could use this to expose sensitive
information (read memory from another guest VM). (CVE-2019-3016)
Al Viro discovered that the vfs layer in the Linux kernel contained
a use- after-free vulnerability. A local attacker could use this to
cause a denial of service (system crash) or possibly expose
OSV
linux-aws-5.0, linux-gcp, linux-gke-5.0, linux-oracle-5.0, linux-azure vulnerabilities
osv·2020-03-25·CVSS 7.5
CVE-2019-3016 [HIGH] linux-aws-5.0, linux-gcp, linux-gke-5.0, linux-oracle-5.0, linux-azure vulnerabilities
linux-aws-5.0, linux-gcp, linux-gke-5.0, linux-oracle-5.0, linux-azure vulnerabilities
It was discovered that the KVM implementation in the Linux kernel, when
paravirtual TLB flushes are enabled in guests, the hypervisor in some
situations could miss deferred TLB flushes or otherwise mishandle them. An
attacker in a guest VM could use this to expose sensitive information (read
memory from another guest VM). (CVE-2019-3016)
Paulo Bonzini discovered that the KVM hypervisor implementation in the
Linux kernel could improperly let a nested (level 2) guest access the
resources of a parent (level 1) guest in certain situations. An attacker
could use this to expose sensitive information. (CVE-2020-2732)
It was discovered that the RPMSG character device interface in the Linux
kernel did not prop
OSV
linux, linux-aws, linux-gcp, linux-gcp-5.3, linux-gke-5.3, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-raspi2-5.3, linux-azure, linux-azure-5.3 vulnerabilities
osv·2020-03-25·CVSS 4.6
[MEDIUM] linux, linux-aws, linux-gcp, linux-gcp-5.3, linux-gke-5.3, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-raspi2-5.3, linux-azure, linux-azure-5.3 vulnerabilities
linux, linux-aws, linux-gcp, linux-gcp-5.3, linux-gke-5.3, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-raspi2-5.3, linux-azure, linux-azure-5.3 vulnerabilities
It was discovered that the KVM implementation in the Linux kernel, when
paravirtual TLB flushes are enabled in guests, the hypervisor in some
situations could miss deferred TLB flushes or otherwise mishandle them. An
attacker in a guest VM could use this to expose sensitive information (read
memory from another guest VM). (CVE-2019-3016)
Paulo Bonzini discovered that the KVM hypervisor implementation in the
Linux kernel could improperly let a nested (level 2) guest access the
resources of a parent (level 1) guest in certain situations. An attacker
could use this to expose sensitive information. (CVE-2020-2732)
It was
OSV
CVE-2019-3016: In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same gues
osv·2020-01-31·CVSS 4.7
CVE-2019-3016 [MEDIUM] CVE-2019-3016: In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same gues
In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.
Kernel
Merge branch 'cve-2019-3016' into kvm-next-5.6
kernel_security·2020-01-30
CVE-2019-3016 Merge branch 'cve-2019-3016' into kvm-next-5.6
Merge branch 'cve-2019-3016' into kvm-next-5.6
From Boris Ostrovsky:
The KVM hypervisor may provide a guest with ability to defer remote TLB
flush when the remote VCPU is not running. When this feature is used,
the TLB flush will happen only when the remote VPCU is scheduled to run
again. This will avoid unnecessary (and expensive) IPIs.
Under certain circumstances, when a guest initiates such deferred action,
the hypervisor may miss the request. It is also possible that the guest
may mistakenly assume that it has already marked remote VCPU as needing
a flush when in fact that request had already been processed by the
hypervisor. In both cases this will result in an invalid translation
being present in a vCPU, potentially allowing accesses to memory locations
in that guest's address spa
Kernel
x86/KVM: Clean up host's steal time structure
kernel_security·2019-12-06·CVSS 6.2
CVE-2019-3016 [MEDIUM] x86/KVM: Clean up host's steal time structure
x86/KVM: Clean up host's steal time structure
Now that we are mapping kvm_steal_time from the guest directly we
don't need keep a copy of it in kvm_vcpu_arch.st. The same is true
for the stime field.
This is part of CVE-2019-3016.
Signed-off-by: Boris Ostrovsky
Reviewed-by: Joao Martins
Cc: [email protected]
Signed-off-by: Paolo Bonzini
Kernel
x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed
kernel_security·2019-12-05·CVSS 6.2
CVE-2019-3016 [MEDIUM] x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed
x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed
There is a potential race in record_steal_time() between setting
host-local vcpu->arch.st.steal.preempted to zero (i.e. clearing
KVM_VCPU_PREEMPTED) and propagating this value to the guest with
kvm_write_guest_cached(). Between those two events the guest may
still see KVM_VCPU_PREEMPTED in its copy of kvm_steal_time, set
KVM_VCPU_FLUSH_TLB and assume that hypervisor will do the right
thing. Which it won't.
Instad of copying, we should map kvm_steal_time and that will
guarantee atomicity of accesses to @preempted.
This is part of CVE-2019-3016.
Signed-off-by: Boris Ostrovsky
Reviewed-by: Joao Martins
Cc: [email protected]
Signed-off-by: Paolo Bonzini
Kernel
x86/kvm: Cache gfn to pfn translation
kernel_security·2019-12-05·CVSS 6.2
CVE-2019-3016 [MEDIUM] x86/kvm: Cache gfn to pfn translation
x86/kvm: Cache gfn to pfn translation
__kvm_map_gfn()'s call to gfn_to_pfn_memslot() is
* relatively expensive
* in certain cases (such as when done from atomic context) cannot be called
Stashing gfn-to-pfn mapping should help with both cases.
This is part of CVE-2019-3016.
Signed-off-by: Boris Ostrovsky
Reviewed-by: Joao Martins
Cc: [email protected]
Signed-off-by: Paolo Bonzini
Kernel
x86/kvm: Introduce kvm_(un)map_gfn()
kernel_security·2019-11-12·CVSS 6.2
CVE-2019-3016 [MEDIUM] x86/kvm: Introduce kvm_(un)map_gfn()
x86/kvm: Introduce kvm_(un)map_gfn()
kvm_vcpu_(un)map operates on gfns from any current address space.
In certain cases we want to make sure we are not mapping SMRAM
and for that we can use kvm_(un)map_gfn() that we are introducing
in this patch.
This is part of CVE-2019-3016.
Signed-off-by: Boris Ostrovsky
Reviewed-by: Joao Martins
Cc: [email protected]
Signed-off-by: Paolo Bonzini
Kernel
x86/kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit
kernel_security·2019-10-30·CVSS 6.2
CVE-2019-3016 [MEDIUM] x86/kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit
x86/kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit
kvm_steal_time_set_preempted() may accidentally clear KVM_VCPU_FLUSH_TLB
bit if it is called more than once while VCPU is preempted.
This is part of CVE-2019-3016.
(This bug was also independently discovered by Jim Mattson
)
Signed-off-by: Boris Ostrovsky
Reviewed-by: Joao Martins
Cc: [email protected]
Signed-off-by: Paolo Bonzini
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-3016 kernel: kvm: Information leak within a KVM guest [fedora-all]
bugzilla·2020-01-30·CVSS 6.2
CVE-2019-3016 [MEDIUM] CVE-2019-3016 kernel: kvm: Information leak within a KVM guest [fedora-all]
CVE-2019-3016 kernel: kvm: Information leak within a KVM guest [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions o
Bugzilla
CVE-2019-3016 kernel: kvm: Information leak within a KVM guest
bugzilla·2020-01-17·CVSS 6.2
CVE-2019-3016 [MEDIUM] CVE-2019-3016 kernel: kvm: Information leak within a KVM guest
CVE-2019-3016 kernel: kvm: Information leak within a KVM guest
A flaw was found in the way Linux kernel's KVM hypervisor handled deferred TLB
flush requests from guest. A race condition may occur between guest issuing
a deferred TLB flush request to KVM and KVM handling and acknowledging it.
This may result in invalid address translations from TLB being used to access
guest memory, leading to potential information leakage issue.
A guest user/process may use this flaw to access guest memory locations which
it should not have access to.
Upstream patches:
-> https://git.kernel.org/linus/a6bd811f1209fe1c64c9f6fd578101d6436c6b6e
-> https://git.kernel.org/linus/b043138246a41064527cf019a3d51d9f015e9796
-> https://git.kernel.org/linus/917248144db5d7320655dbb41d3af0b8a0f3d589
-> https://git.kern
http://packetstormsecurity.com/files/157233/Kernel-Live-Patch-Security-Notice-LSN-0065-1.htmlhttp://www.openwall.com/lists/oss-security/2020/01/30/4https://bugzilla.redhat.com/show_bug.cgi?id=1792167https://git.kernel.org/linus/1eff70a9abd46f175defafd29bc17ad456f398a7https://git.kernel.org/linus/8c6de56a42e0c657955e12b882a81ef07d1d073ehttps://git.kernel.org/linus/917248144db5d7320655dbb41d3af0b8a0f3d589https://git.kernel.org/linus/a6bd811f1209fe1c64c9f6fd578101d6436c6b6ehttps://git.kernel.org/linus/b043138246a41064527cf019a3d51d9f015e9796https://lore.kernel.org/lkml/1580407316-11391-1-git-send-email-pbonzini%40redhat.com/https://security.netapp.com/advisory/ntap-20200313-0003/https://usn.ubuntu.com/4300-1/https://usn.ubuntu.com/4301-1/https://www.debian.org/security/2020/dsa-4699http://packetstormsecurity.com/files/157233/Kernel-Live-Patch-Security-Notice-LSN-0065-1.htmlhttp://www.openwall.com/lists/oss-security/2020/01/30/4https://bugzilla.redhat.com/show_bug.cgi?id=1792167https://git.kernel.org/linus/1eff70a9abd46f175defafd29bc17ad456f398a7https://git.kernel.org/linus/8c6de56a42e0c657955e12b882a81ef07d1d073ehttps://git.kernel.org/linus/917248144db5d7320655dbb41d3af0b8a0f3d589https://git.kernel.org/linus/a6bd811f1209fe1c64c9f6fd578101d6436c6b6ehttps://git.kernel.org/linus/b043138246a41064527cf019a3d51d9f015e9796https://lore.kernel.org/lkml/1580407316-11391-1-git-send-email-pbonzini%40redhat.com/https://security.netapp.com/advisory/ntap-20200313-0003/https://usn.ubuntu.com/4300-1/https://usn.ubuntu.com/4301-1/https://www.debian.org/security/2020/dsa-4699
2020-01-31
Published