CVE-2019-19338: Medium severity ibm data risk manager vulnerability
A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error occurs. When a guest is running on a host CPU affected by the TAA flaw (TAANO=0), but is not affected by the MDS issue (MDSNO=1), the guest was to clear the affected buffers by using a VERW instruction mechanism. But when the MDSNO=1 bit was exported to the guests, the guests did not use the VERW mechanism to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.
Other sources
A flaw was found in the fix for CVE-2019-11135, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error occurs. When a guest is running on a host CPU affected by the TAA flaw (TAANO=0), but is not affected by the MDS issue (MDSNO=1), the guest was to clear the affected buffers by using a VERW instruction mechanism. But when the MDSNO=1 bit was exported to the guests, the guests did not use the VERW mechanism to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.
Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by a Transaction Asynchronous Abort (TAA) h/w issue in KVM. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
— IBM
Transaction Asynchronous Abort (TAA) h/w issue, which affects Intel CPUs, is mitigated in two ways. One is by disabling Transactional Synchronisation Extensions (TSX) feature of the CPU. And second is by clearing the affected Store/Fill/Load port architectural buffers, which may hold sensitive information bits.
It was found that the current kernel fixes don't completely fix TAA issue for the guest VMs. When a guest is running on a host CPU affected by TAA flaw (ie. TAANO=0) but not affected by MDS issue (ie MDSNO=1), to mitigate TAA issue, guest was to clear the affected buffers by using VERW instruction mechanism. But when MDSNO=1 bit was exported to the guests, guest did not quite use the VERW mechanism to clear the affected buffers.
This issue affects guests running on Cascade Lake CPUs, which are affected by the TAA (ie. TAANO=0) issue, but are not affected by the MDS (ie. MDSNO=1) issue.
It requires that host has 'TSX' enabled.
Upstream patches: ----------------- -> https://git.kernel.org/linus/cbbaa2727aa3ae9e0a844803da7cef7fd3b94f2b -> https://git.kernel.org/linus/c11f83e0626bdc2b6c550fc8b9b6eeefbd8cefaa -> https://git.kernel.org/linus/b07a5c53d42a8c87b208614129e947dd2338ff9c
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/12/10/3
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-19338?
CVE-2019-19338 is classified as a medium-severity vulnerability due to its impact on speculative execution handling in affected Intel CPUs.
How do I fix CVE-2019-19338?
To fix CVE-2019-19338, upgrade to a kernel version that is at least 5.5 or install the recommended updates for your Red Hat or IBM systems.
Which systems are affected by CVE-2019-19338?
CVE-2019-19338 affects Linux kernel versions prior to 5.5, including specific Red Hat and IBM products as detailed in the vulnerability report.
Is CVE-2019-19338 related to other vulnerabilities?
Yes, CVE-2019-19338 is a flaw found in the fix for another vulnerability, CVE-2019-11135, and it affects speculative execution handling.
What type of attack can exploit CVE-2019-19338?
CVE-2019-19338 can potentially be exploited to execute unauthorized code due to improper speculative execution management in affected Intel CPUs.