CVE-2019-7222
Publication date 21 March 2019
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.
From the Ubuntu Security Team
Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux kernel, when nested virtualization is used. A local attacker could use this to expose sensitive information (host system memory to a guest VM).
Status
Package | Ubuntu Release | Status |
---|---|---|
linux | ||
18.04 LTS bionic |
Fixed 4.15.0-47.50
|
|
16.04 LTS xenial |
Fixed 4.4.0-145.171
|
|
14.04 LTS trusty |
Fixed 3.13.0-168.218
|
|
linux-aws | ||
18.04 LTS bionic |
Fixed 4.15.0-1035.37
|
|
16.04 LTS xenial |
Fixed 4.4.0-1079.89
|
|
14.04 LTS trusty |
Fixed 4.4.0-1040.43
|
|
linux-aws-hwe | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial |
Fixed 4.15.0-1035.37~16.04.1
|
|
14.04 LTS trusty | Not in release | |
linux-azure | ||
18.04 LTS bionic |
Fixed 4.18.0-1014.14~18.04.1
|
|
16.04 LTS xenial |
Fixed 4.15.0-1041.45
|
|
14.04 LTS trusty |
Fixed 4.15.0-1041.45~14.04.1
|
|
linux-azure-edge | ||
18.04 LTS bionic |
Fixed 4.18.0-1014.14~18.04.1
|
|
16.04 LTS xenial |
Fixed 4.15.0-1041.45
|
|
14.04 LTS trusty | Not in release | |
linux-euclid | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Ignored | |
14.04 LTS trusty | Not in release | |
linux-flo | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Ignored | |
14.04 LTS trusty | Not in release | |
linux-gcp | ||
18.04 LTS bionic |
Fixed 4.15.0-1029.31
|
|
16.04 LTS xenial |
Fixed 4.15.0-1029.31~16.04.1
|
|
14.04 LTS trusty | Not in release | |
linux-gcp-edge | ||
18.04 LTS bionic |
Fixed 4.18.0-1008.9~18.04.1
|
|
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-gke | ||
18.04 LTS bionic |
Not affected
|
|
16.04 LTS xenial | Ignored | |
14.04 LTS trusty | Not in release | |
linux-goldfish | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Ignored | |
14.04 LTS trusty | Not in release | |
linux-grouper | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-hwe | ||
18.04 LTS bionic |
Fixed 4.18.0-17.18~18.04.1
|
|
16.04 LTS xenial |
Fixed 4.15.0-47.50~16.04.1
|
|
14.04 LTS trusty | Not in release | |
linux-hwe-edge | ||
18.04 LTS bionic |
Not affected
|
|
16.04 LTS xenial |
Fixed 4.15.0-47.50~16.04.1
|
|
14.04 LTS trusty | Not in release | |
linux-kvm | ||
18.04 LTS bionic |
Fixed 4.15.0-1031.31
|
|
16.04 LTS xenial |
Fixed 4.4.0-1043.49
|
|
14.04 LTS trusty | Not in release | |
linux-lts-trusty | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-lts-utopic | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Ignored | |
linux-lts-vivid | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Ignored | |
linux-lts-wily | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Ignored | |
linux-lts-xenial | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty |
Fixed 4.4.0-144.170~14.04.1
|
|
linux-maguro | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-mako | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Ignored | |
14.04 LTS trusty | Not in release | |
linux-manta | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-oem | ||
18.04 LTS bionic |
Fixed 4.15.0-1035.40
|
|
16.04 LTS xenial | Ignored | |
14.04 LTS trusty | Not in release | |
linux-oracle | ||
18.04 LTS bionic |
Fixed 4.15.0-1010.12
|
|
16.04 LTS xenial |
Fixed 4.15.0-1010.12~16.04.1
|
|
14.04 LTS trusty | Not in release | |
linux-raspi2 | ||
18.04 LTS bionic |
Fixed 4.15.0-1033.35
|
|
16.04 LTS xenial |
Fixed 4.4.0-1106.114
|
|
14.04 LTS trusty | Not in release | |
linux-snapdragon | ||
18.04 LTS bionic |
Fixed 4.15.0-1053.57
|
|
16.04 LTS xenial |
Fixed 4.4.0-1110.115
|
|
14.04 LTS trusty | Not in release |
Notes
tyhicks
Ubuntu kernels do not enable nested KVM virtualization by default and are unaffected by this flaw in the default configuration. However, installing QEMU results in nested KVM support to be enabled via the /etc/modprobe.d/qemu-system-x86.conf file. To ensure that nested virtualization is not enabled, verify that the /sys/module/kvm_intel/parameters/nested file contains "N".
Severity score breakdown
Parameter | Value |
---|---|
Base score | 5.5 · Medium |
Attack vector | Local |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | None |
Availability impact | None |
Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-3932-1
- Linux kernel vulnerabilities
- 2 April 2019
- USN-3932-2
- Linux kernel (Xenial HWE) vulnerabilities
- 2 April 2019
- USN-3933-2
- Linux kernel (Trusty HWE) vulnerabilities
- 2 April 2019
- USN-3933-1
- Linux kernel vulnerabilities
- 2 April 2019
- USN-3930-2
- Linux kernel (HWE) vulnerabilities
- 2 April 2019
- USN-3930-1
- Linux kernel vulnerabilities
- 2 April 2019
- USN-3931-2
- Linux kernel (HWE) vulnerabilities
- 2 April 2019
- USN-3931-1
- Linux kernel vulnerabilities
- 2 April 2019