linux linux_kernel
En bref
- Source
- NVD
- EPSS
- EPSS 0.62 % · centile 50 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- oracle
- Statut NVD
- Modified
Description
In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.
Faiblesses (CWE)
- CWE-362 — Situation de compétition
- CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
Références
- http://www.openwall.com/lists/oss-security/2020/01/30/4
- https://lore.kernel.org/lkml/1580407316-11391-1-git-send-email-pbonzini%40redhat.com/
- https://bugzilla.redhat.com/show_bug.cgi?id=1792167
- https://git.kernel.org/linus/8c6de56a42e0c657955e12b882a81ef07d1d073e
- https://git.kernel.org/linus/1eff70a9abd46f175defafd29bc17ad456f398a7
- https://git.kernel.org/linus/917248144db5d7320655dbb41d3af0b8a0f3d589
- https://git.kernel.org/linus/b043138246a41064527cf019a3d51d9f015e9796
- https://git.kernel.org/linus/a6bd811f1209fe1c64c9f6fd578101d6436c6b6e
- https://security.netapp.com/advisory/ntap-20200313-0003/
- https://usn.ubuntu.com/4300-1/
- https://usn.ubuntu.com/4301-1/
- http://packetstormsecurity.com/files/157233/Kernel-Live-Patch-Security-Notice-LSN-0065-1.html
- https://www.debian.org/security/2020/dsa-4699
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | oracle |
| CVSS 3.1 | MEDIUM 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · secalert_us@oracle.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.7 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 1.9 | AV:L/AC:M/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2019-12655
- GCVE · GCVE-0-2019-3016
Avis du CERT-FR
- CERTFR-2020-AVI-459 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2020-AVI-368 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
- CERTFR-2020-AVI-154 — Multiples vulnérabilités dans le noyau Linux d’Ubuntu · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.16cpe:2.3:o:linux:linux_kernel:4.10:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| linux · linux_kernel | affected 4.10 to 5.6 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |