Input validation error in Linux kernel - CVE-2019-3887
Published: April 9, 2019 / Updated: May 21, 2019
Vulnerability identifier: #VU28393
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-3887
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local authenticated user to a crash the entire system.
A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue.
Affected software
Linux kernel
Fedora
kernel
kernel-headers
kernel-tools
Fedora
kernel
kernel-headers
kernel-tools
How to mitigate CVE-2019-3887
Install update from vendor's website.
Linux kernel - update to 4.19.35
kernel - addressed in versions 5.0.7-100.fc28, 5.0.7-200.fc29, 5.0.7-300.fc30
kernel-headers - addressed in versions 5.0.7-100.fc28, 5.0.7-200.fc29, 5.0.7-300.fc30
kernel-tools - addressed in versions 5.0.7-100.fc28, 5.0.7-200.fc29, 5.0.7-300.fc30
kernel - addressed in versions 5.0.7-100.fc28, 5.0.7-200.fc29, 5.0.7-300.fc30
kernel-headers - addressed in versions 5.0.7-100.fc28, 5.0.7-200.fc29, 5.0.7-300.fc30
kernel-tools - addressed in versions 5.0.7-100.fc28, 5.0.7-200.fc29, 5.0.7-300.fc30