SB2019091829 - Ubuntu update for linux, linux-aws, linux-aws-hwe and more

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019091829

SB2019091829 - Ubuntu update for linux, linux-aws, linux-aws-hwe and more

Published: September 18, 2019 Updated: October 31, 2026

Security Bulletin ID SB2019091829
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Adjecent network
Highest impact Code execution

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2019-14835)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 7.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to a boundary error within the vhost/vhost_net Linux kernel module during the live migration flow when processing dirty log entries. A privileged guest user can pass descriptors with invalid length to the host when migration is on the way, trigger buffer overflow and execute arbitrary code on the host OS.


2) Input validation error (CVE-ID: CVE-2019-15030)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local authenticated user to #BASIC_IMPACT#.

In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable exception. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process because of a missing arch/powerpc/kernel/process.c check.


3) Information disclosure (CVE-ID: CVE-2019-15031)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local authenticated user to #BASIC_IMPACT#.

In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via an interrupt. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process, because MSR_TM_ACTIVE is misused in arch/powerpc/kernel/process.c.


Remediation

Install update from vendor's website.

References