CVE-2019-3887

Опубликовано: 09 апр. 2019

Источник: nvd

CVSS3: 6.7

CVSS3: 5.6

CVSS2: 4.7

EPSS Низкий

Описание

A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue.

Ссылки

http://www.securityfocus.com/bid/107850
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:2703
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2741
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3887
Issue Tracking
Patch
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWPOIII2L73HV5PGXSGMRMKQIK47UIYE/
https://usn.ubuntu.com/3979-1/
Third Party Advisory
https://usn.ubuntu.com/3980-1/
Third Party Advisory
https://usn.ubuntu.com/3980-2/
Third Party Advisory
http://www.securityfocus.com/bid/107850
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:2703
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2741
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3887
Issue Tracking
Patch
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWPOIII2L73HV5PGXSGMRMKQIK47UIYE/
https://usn.ubuntu.com/3979-1/
Third Party Advisory
https://usn.ubuntu.com/3980-1/
Third Party Advisory
https://usn.ubuntu.com/3980-2/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 4.16 (включая)

Конфигурация 2

cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_real_time:8:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv:8:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_tus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_real_time_tus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_real_time_tus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*

EPSS

Процентиль: 7%

0.00028

Низкий

6.7 Medium

CVSS3

5.6 Medium

CVSS3

4.7 Medium

CVSS2

Дефекты

CWE-863

Связанные уязвимости

CVE-2019-3887

CVSS3: 5.6

ubuntu

больше 6 лет назад

CVE-2019-3887

CVSS3: 6.7

redhat

больше 6 лет назад

CVE-2019-3887

CVSS3: 5.6

msrc

около 5 лет назад

A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that L1 guest could access L0's APIC register values via L2 guest when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue.

CVE-2019-3887

CVSS3: 5.6

debian

больше 6 лет назад

A flaw was found in the way KVM hypervisor handled x2APIC Machine Spec ...

GHSA-j2cm-6mgm-v7v4

CVSS3: 5.6

github

больше 3 лет назад

EPSS

Процентиль: 7%

0.00028

Низкий

6.7 Medium

CVSS3

5.6 Medium

CVSS3

4.7 Medium

CVSS2

Дефекты

CWE-863