CVE-2020-8832
published 2020-04-10CVE-2020-8832: The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux kernel did not properly clear data structures on context switches for certain…
PriorityP423medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.45%
37.0th percentile
The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors.") was discovered to be incomplete, meaning that in versions of the kernel before 4.15.0-91.92, an attacker could use this vulnerability to expose sensitive information.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | linux | < linux 4.16.5-1 (bookworm) | linux 4.16.5-1 (bookworm) |
| linux | linux_kernel | >= 0 < 4.16.5-1 | 4.16.5-1 |
| linux | linux_kernel | >= 0 < 4.16.5-1 | 4.16.5-1 |
| linux | linux_kernel | >= 0 < 4.16.5-1 | 4.16.5-1 |
| linux | linux_kernel | >= 0 < 4.16.5-1 | 4.16.5-1 |
| linux | linux_kernel | >= 0 < 4.15.0-91.92 | 4.15.0-91.92 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: incomplete fix for CVE-2019-14615 allows for a local information exposure
vendor_redhat·2020-03-25·CVSS 5.5
CVE-2020-8832 [MEDIUM] CWE-112 kernel: incomplete fix for CVE-2019-14615 allows for a local information exposure
kernel: incomplete fix for CVE-2019-14615 allows for a local information exposure
The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors.") was discovered to be incomplete, meaning that in versions of the kernel before 4.15.0-91.92, an attacker could use this vulnerability to expose sensitive information.
An information disclosure flaw was found in the Linux kernel. The original fix for CVE-2019-14615 was deemed to be incomplete. The i915 graphics driver lacks control of flow for data structures which may allow a local, authenticated user to disclose information when using ioctl commands with an attached i915 device. The highest threat from this vulnerability i
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-03-25·CVSS 5.5
CVE-2019-15217 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Paulo Bonzini discovered that the KVM hypervisor implementation in the
Linux kernel could improperly let a nested (level 2) guest access the
resources of a parent (level 1) guest in certain situations. An attacker
could use this to expose sensitive information. (CVE-2020-2732)
Gregory Herrero discovered that the fix for CVE-2019-14615 to address the
Linux kernel not properly clearing data structures on context switches for
certain Intel graphics processors was incomplete. A local attacker could
use this to expose sensitive information. (CVE-2020-8832)
It was discovered that the IPMI message handler implementation in the Linux
kernel did not properly deallocate memory in certain situatio
Debian
CVE-2020-8832: linux - The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux ...
vendor_debian·2020·CVSS 5.5
CVE-2020-8832 [MEDIUM] CVE-2020-8832: linux - The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux ...
The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors.") was discovered to be incomplete, meaning that in versions of the kernel before 4.15.0-91.92, an attacker could use this vulnerability to expose sensitive information.
Scope: local
bookworm: resolved (fixed in 4.16.5-1)
bullseye: resolved (fixed in 4.16.5-1)
forky: resolved (fixed in 4.16.5-1)
sid: resolved (fixed in 4.16.5-1)
trixie: resolved (fixed in 4.16.5-1)
GHSA
GHSA-xqc2-q3vp-2m56: The fix for the Linux kernel in Ubuntu 18
ghsa_unreviewed·2022-05-24·CVSS 5.5
CVE-2020-8832 [MEDIUM] CWE-200 GHSA-xqc2-q3vp-2m56: The fix for the Linux kernel in Ubuntu 18
The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors.") was discovered to be incomplete, meaning that in versions of the kernel before 4.15.0-91.92, an attacker could use this vulnerability to expose sensitive information.
OSV
CVE-2020-8832: The fix for the Linux kernel in Ubuntu 18
osv·2020-04-10·CVSS 5.5
CVE-2020-8832 [MEDIUM] CVE-2020-8832: The fix for the Linux kernel in Ubuntu 18
The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors.") was discovered to be incomplete, meaning that in versions of the kernel before 4.15.0-91.92, an attacker could use this vulnerability to expose sensitive information.
OSV
linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon, linux-azure vulnerabilities
osv·2020-03-25·CVSS 5.5
CVE-2020-2732 [MEDIUM] linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon, linux-azure vulnerabilities
linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon, linux-azure vulnerabilities
Paulo Bonzini discovered that the KVM hypervisor implementation in the
Linux kernel could improperly let a nested (level 2) guest access the
resources of a parent (level 1) guest in certain situations. An attacker
could use this to expose sensitive information. (CVE-2020-2732)
Gregory Herrero discovered that the fix for CVE-2019-14615 to address the
Linux kernel not properly clearing data structures on context switches for
certain Intel graphics processors was incomplete. A local attacker could
use this to expose sensitive information. (CVE-2020-8832)
It was discovered that the IPMI message handler implementation in the Li
No detection rules found.
No public exploits indexed.
arXiv
Characteristics, Root Causes, and Detection of Incomplete Security Bug Fixes in the Linux Kernel
arxiv_fulltext·2025-11-21
Characteristics, Root Causes, and Detection of Incomplete Security Bug Fixes in the Linux Kernel
Characteristics, Root Causes, and Detection of
Incomplete Security Bug Fixes in the Linux Kernel
Qiang Liu^1All work was done by Aug., 2022.,
Wenlong Zhang^1,
Muhui Jiang^2,1,
Lei Wu^1,
Yajin Zhou^1
^1Zhejiang University,
^2The Hong Kong Polytechnic University
## Abstract
Security bugs in the Linux kernel emerge endlessly and have attracted much
attention.
However, fixing security bugs in the Linux kernel could be incomplete due to
human mistakes.
Specifically, an incomplete fix fails to repair all the original security
defects in the software, fails to properly repair the original security defects,
or introduces new ones.
In this paper, we study the fixes of incomplete security bugs in the Linux
kernel for the first time, and reveal their characteristics, root causes as well
as de
Bugzilla
CVE-2020-8832 kernel: incomplete fix for CVE-2019-14615 allows for a local information exposure [fedora-all]
bugzilla·2020-03-25·CVSS 5.5
CVE-2020-8832 [MEDIUM] CVE-2020-8832 kernel: incomplete fix for CVE-2019-14615 allows for a local information exposure [fedora-all]
CVE-2020-8832 kernel: incomplete fix for CVE-2019-14615 allows for a local information exposure [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affe
Bugzilla
CVE-2020-8832 kernel: incomplete fix for CVE-2019-14615 allows for a local information exposure
bugzilla·2020-03-25·CVSS 5.5
CVE-2020-8832 [MEDIUM] CVE-2020-8832 kernel: incomplete fix for CVE-2019-14615 allows for a local information exposure
CVE-2020-8832 kernel: incomplete fix for CVE-2019-14615 allows for a local information exposure
The fix for CVE-2019-14615 to address the Linux kernel not properly clearing data structures on context switches for certain Intel graphics processors was incomplete. A local attacker could use this to expose sensitive information.
https://lists.ubuntu.com/archives/kernel-team/2020-February/107444.html
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1817048]
---
Mitigation:
Preventing loading of the i915 kernel module will prevent attackers from using this exploit against the system; however, the power management functionality of the card will be disabled and the system may draw additional power. See the kcs “How do I blacklist a kernel module to prevent
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1862840https://security.netapp.com/advisory/ntap-20200430-0004/https://usn.ubuntu.com/usn/usn-4302-1https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1862840https://security.netapp.com/advisory/ntap-20200430-0004/https://usn.ubuntu.com/usn/usn-4302-1
2020-04-10
Published