CVE-2019-19338

Katalog CVE

CVSS 5.5 · Medium EPSS 0,48%

Kerentanan Observable Discrepancy pada linux kernel, redhat enterprise linux. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.

Rincian

Terbit di NVD

13 Juli 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-203: Observable Discrepancy
CWE-385: Covert Timing Channel

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19338 issue tracking · patch · advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2019/12/10/3 mailing list · patch · advisory pihak ketiga
• https://software.intel.com/security-software-guidance/insights/deep-dive-intel-transactional-synchronization-e... advisory pihak ketiga