vulnerability
Oracle Linux: CVE-2019-15031: ELSA-2020-1372: kernel security and bug fix update (MODERATE) (Multiple Advisories)
Severity | CVSS | Published | Added | Modified |
---|---|---|---|---|
3 | (AV:L/AC:L/Au:S/C:P/I:N/A:P) | Sep 13, 2019 | Oct 5, 2022 | Nov 29, 2024 |
Severity
3
CVSS
(AV:L/AC:L/Au:S/C:P/I:N/A:P)
Published
Sep 13, 2019
Added
Oct 5, 2022
Modified
Nov 29, 2024
Description
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via an interrupt. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process, because MSR_TM_ACTIVE is misused in arch/powerpc/kernel/process.c.
A flaw in the Linux kernel on the PowerPC platform, was found where a local user can read vector registers of other user processes (during a hardware interrupt). An attacker must start a transaction when the FPU operation begins or there is no leakage. Vector registers will become corrupted with values from the different local Linux processes, because of the missing check inside arch/powerpc/kernel/process.c. The highest threat from this vulnerability is confidentiality of data and availability of the system.
A flaw in the Linux kernel on the PowerPC platform, was found where a local user can read vector registers of other user processes (during a hardware interrupt). An attacker must start a transaction when the FPU operation begins or there is no leakage. Vector registers will become corrupted with values from the different local Linux processes, because of the missing check inside arch/powerpc/kernel/process.c. The highest threat from this vulnerability is confidentiality of data and availability of the system.
Solution
oracle-linux-upgrade-kernel

NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.