CVE-2019-15031: canonical ubuntu_linux Improper Synchronization

Vulnerability summary

CVE-2019-15031 is a medium (CVSS 4.4) Improper Synchronization vulnerability in canonical ubuntu_linux. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 46.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 13-09-2019
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via an interrupt. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process, because MSR_TM_ACTIVE is misused in arch/powerpc/kernel/process.c.

• CWE-662Improper SynchronizationThe product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.