Vulnerability Description
In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 4.16 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/157233/Kernel-Live-Patch-Security-Notice-LS
- http://www.openwall.com/lists/oss-security/2020/01/30/4Mailing ListThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1792167Issue TrackingThird Party Advisory
- https://git.kernel.org/linus/1eff70a9abd46f175defafd29bc17ad456f398a7PatchVendor Advisory
- https://git.kernel.org/linus/8c6de56a42e0c657955e12b882a81ef07d1d073ePatchVendor Advisory
- https://git.kernel.org/linus/917248144db5d7320655dbb41d3af0b8a0f3d589PatchVendor Advisory
- https://git.kernel.org/linus/a6bd811f1209fe1c64c9f6fd578101d6436c6b6ePatchVendor Advisory
- https://git.kernel.org/linus/b043138246a41064527cf019a3d51d9f015e9796PatchVendor Advisory
- https://lore.kernel.org/lkml/1580407316-11391-1-git-send-email-pbonzini%40redhat
- https://security.netapp.com/advisory/ntap-20200313-0003/
- https://usn.ubuntu.com/4300-1/
- https://usn.ubuntu.com/4301-1/
- https://www.debian.org/security/2020/dsa-4699
- http://packetstormsecurity.com/files/157233/Kernel-Live-Patch-Security-Notice-LS
- http://www.openwall.com/lists/oss-security/2020/01/30/4Mailing ListThird Party Advisory
FAQ
What is CVE-2019-3016?
CVE-2019-3016 is a vulnerability with a CVSS score of 6.2 (MEDIUM). In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux...
How severe is CVE-2019-3016?
CVE-2019-3016 has been rated MEDIUM with a CVSS base score of 6.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-3016?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel.