CVE-2019-7222

moderate-risk

Published 2019-03-21

The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.

Do I need to act?

0.04% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.5/10 Medium

LOCAL / LOW complexity

Affected Products (20)

Linux Kernel

Fedora

Leap

Debian Linux

Ubuntu Linux

Active Iq Performance Analytics Services

Element Software Management Node

Enterprise Linux

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux For Real Time

Affected Vendors

Debian Redhat Linux Canonical Fedoraproject Netapp Opensuse

References (50)

Broken Link http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00042.html

Third Party Advisory http://packetstormsecurity.com/files/151712/KVM-kvm_inject_page_fault-Uninitiali...

Mailing List http://www.openwall.com/lists/oss-security/2019/02/18/2

Broken Link http://www.securityfocus.com/bid/106963

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2029

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2043

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:3309

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:3517

Exploit https://bugs.chromium.org/p/project-zero/issues/detail?id=1759

Patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35...

Third Party Advisory https://github.com/torvalds/linux/commits/master/arch/x86/kvm

Mailing List https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html

Mailing List https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html

Mailing List https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.netapp.com/advisory/ntap-20190404-0002/

Third Party Advisory https://usn.ubuntu.com/3930-1/

Third Party Advisory https://usn.ubuntu.com/3930-2/

Third Party Advisory https://usn.ubuntu.com/3931-1/

and 30 more references

/ 100

moderate-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 23/34 · High