CVE-2019-3016

CVSS V2 Low 1.9 CVSS V3 Medium 4.7
Description
In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.
Overview
  • CVE ID
  • CVE-2019-3016
  • Assigner
  • secalert_us@oracle.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2020-01-31T20:15:11
  • Last Modified Date
  • 2020-06-10T20:15:12
Weakness Enumerations
CWE URL
CWE-362 http://cwe.mitre.org/data/definitions/362.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 1 OR 4.16
cpe:2.3:o:linux:linux_kernel:4.10:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:L/AC:M/Au:N/C:P/I:N/A:N
  • Access Vector
  • LOCAL
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • NONE
  • Availability Impact
  • NONE
  • Base Score
  • 1.9
  • Severity
  • LOW
  • Exploitability Score
  • 3.4
  • Impact Score
  • 2.9
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
  • Attack Vector
  • LOCAL
  • Attack Compatibility
  • HIGH
  • Privileges Required
  • LOW
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • HIGH
  • Availability Impact
  • NONE
  • Base Score
  • 4.7
  • Base Severity
  • MEDIUM
  • Exploitability Score
  • 1
  • Impact Score
  • 3.6
References
Reference URL Reference Tags
https://lore.kernel.org/lkml/1580407316-11391-1-git-send-email-pbonzini@redhat.com/ Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1792167 Issue Tracking Third Party Advisory
https://git.kernel.org/linus/a6bd811f1209fe1c64c9f6fd578101d6436c6b6e Patch Vendor Advisory
https://git.kernel.org/linus/917248144db5d7320655dbb41d3af0b8a0f3d589 Patch Vendor Advisory
https://git.kernel.org/linus/b043138246a41064527cf019a3d51d9f015e9796 Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2020/01/30/4 Mailing List Third Party Advisory
https://git.kernel.org/linus/8c6de56a42e0c657955e12b882a81ef07d1d073e Patch Vendor Advisory
https://git.kernel.org/linus/1eff70a9abd46f175defafd29bc17ad456f398a7 Patch Vendor Advisory
https://security.netapp.com/advisory/ntap-20200313-0003/
https://usn.ubuntu.com/4300-1/
https://usn.ubuntu.com/4301-1/
http://packetstormsecurity.com/files/157233/Kernel-Live-Patch-Security-Notice-LSN-0065-1.html
https://www.debian.org/security/2020/dsa-4699
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2019-3016
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3016
History
Created Old Value New Value Data Type Notes
2022-05-10 17:28:31 Added to TrackCVE
2022-12-04 10:31:29 2020-01-31T20:15Z 2020-01-31T20:15:11 CVE Published Date updated
2022-12-04 10:31:29 2020-06-10T20:15:12 CVE Modified Date updated
2022-12-04 10:31:29 Modified Vulnerability Status updated