CVE-2019-3016 (Medium) detected in linuxlinux-3.10.11

[mend-bolt-for-github]

CVE-2019-3016 - Medium Severity Vulnerability

Vulnerable Library - linuxlinux-3.10.11

Apache Software Foundation (ASF)

Library home page: https://mirrors.edge.kernel.org/pub/linux/kernel/v3.0/?wsslib=linux

Found in HEAD commit: ac11c9631a8abeed315b67913aab3ba7a400aef3

Found in base branch: cosmic-experimental-1.6

Vulnerable Source Files (2)

android_kernel_samsung_a3xelte/include/linux/kvm_types.h
android_kernel_samsung_a3xelte/include/linux/kvm_types.h

Vulnerability Details

In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.

Publish Date: 2020-01-31

URL: CVE-2019-3016

CVSS 3 Score Details (4.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-3016

Release Date: 2020-01-31

Fix Resolution: v5.6-rc1

---

Step up your Open Source Security Game with WhiteSource here