Linux Kernel up to 5.4 on Intel Speculative Execution covert timing channel

Summaryinfo

A vulnerability identified as problematic has been detected in Linux Kernel up to 5.4 on Intel. This impacts an unknown function of the component Speculative Execution. The manipulation leads to covert timing channel. This vulnerability is traded as CVE-2019-19338. An attack has to be approached locally. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.4 on Intel (Operating System). It has been rated as problematic. This issue affects some unknown functionality of the component Speculative Execution. The manipulation with an unknown input leads to a covert timing channel vulnerability. Using CWE to declare the problem leads to CWE-385. Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information. Impacted is confidentiality. The summary by CVE is:

A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.

The weakness was shared 07/13/2020 as not defined bug report (Bugzilla). It is possible to read the advisory at bugzilla.redhat.com. The identification of this vulnerability is CVE-2019-19338 since 11/27/2019. The exploitation is known to be difficult. Attacking locally is a requirement. A simple authentication is required for exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 208598 (CentOS 7 : kernel (RHSA-2020:0834)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.5 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (208598). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion