CERT-In Vulnerability Note
CIVN-2019-0191
Side Channel Information Disclosure Vulnerability in Linux Kernel
Original Issue Date:December 04, 2019
Severity Rating: MEDIUM
Software Affected
- Linux kernel versions through 5.3.13
Overview
A vulnerability has been reported in Linux kernel which could allow an attacker to obtain sensitive information from the target system.
Description
This vulnerability exists in the Linux kernel for powerpc due to its failure to activate the mitigation for Spectre-RSB(Return Stack Buffer, aka. ret2spec) on context switch, on CPUs prior to Power9DD2.3. An attacker could exploit this vulnerability by executing a specially crafted application to poison the RSB (called Link Stack on Power CPUs).
Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information via a side channel.
Solution
Apply appropriate patches as mentioned in the following links:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=39e72bf96f5847ba87cc5bd7a3ce0fed813dc9ad
http://www.kernel.org
Vendor Information
Kernel.org
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=39e72bf96f5847ba87cc5bd7a3ce0fed813dc9ad
http://www.kernel.org
References
Kernel.org
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=39e72bf96f5847ba87cc5bd7a3ce0fed813dc9ad
http://www.kernel.org
Openwall
https://www.openwall.com/lists/oss-security/2019/11/27/1
Symantec
https://www.symantec.com/security-center/vulnerabilities/writeup/110996?om_rssid=sr-advisories
CVE Name
CVE-2019-18660
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|