CVE-2019-15902 Information disclosure in n/a
A backporting error in the Linux kernel reintroduced a Spectre vulnerability, allowing attackers to potentially read sensitive memory data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-15902?
CVE-2019-15902 is a medium-severity vulnerability in Debian Debian Linux, published on 4 Sep 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A backporting error was discovered in the Linux stable/longterm kernel 4.4.x through 4.4.190, 4.9.x through 4.9.190, 4.14.x through 4.14.141, 4.19.x through 4.19.69, and 5.2.x through 5.2.11. Misuse of the upstream "x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()" commit reintroduced the Spectre vulnerability that it aimed to eliminate. This occurred because the backport process depends on cherry picking specific commits, and because two (correctly ordered) code lines were swapped.
Weakness: CWE-200
Which versions are affected by CVE-2019-15902?
It affects 6 products.
Products include Debian Debian Linux, Linux kernel, Netapp Active Iq Performance Analytics Services, Netapp Baseboard Management Controller Firmware, Netapp Service Processor, Opensuse Leap.
How do I fix CVE-2019-15902?
Apply the vendor's patch.
Is CVE-2019-15902 being exploited?
There is no known exploitation of CVE-2019-15902 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2019-15902, GHSA-vww9-mp9g-8qvc, UBUNTU-CVE-2019-15902.