CVE-2019-3016: linux linux_kernel

Vulnerability summary

CVE-2019-3016 is a medium (CVSS 6.2) vulnerability in linux linux_kernel. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 49.6% of scored vulnerabilities.

Timeline

1. 31-01-2020
   PublishedVulnerability first disclosed.
2. 30-09-2024
   Last modifiedVulnerability information updated.

Description

In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
• CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.