CVE-2019-15030: canonical ubuntu_linux Missing Authorization
Vulnerability summary
CVE-2019-15030 is a medium (CVSS 4.4) Missing Authorization vulnerability in canonical ubuntu_linux. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 39.2% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 4.4, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 18 · Related 16Timeline
- 13-09-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable exception. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process because of a missing arch/powerpc/kernel/process.c check.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
- OSV · DebianEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
EPSS trend
Probability
0.45%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.45% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (git.kernel.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu24 products
- linux< 4.15.0-64.73
- linux-aws< 4.15.0-1050.52
- linux-aws-fips< 4.15.0-2018.18 | All versions (No fix recorded)
- linux-aws-hwe< 4.15.0-1050.52~16.04.1
- linux-azure< 4.15.0-1059.64~14.04.1 | < 4.15.0-1059.64 | < 5.0.0-1020.21~18.04.1
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 19.04
Debian1 product
- linux< 5.2.17-1
Linux1 product
- linux_kernel≤ 5.2.14
Opensuse1 product
- leapEOL15.0 | 15.1
Redhat1 product
- enterprise_linuxEOL7.0 | 8.0
6 vendors · 29 products
References
14 links- www.openwall.com/lists/oss-security/2019/09/10/3X Refsource MISCMailing ListPatchThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
