CVE-2019-3016 Race condition in linux kernel
A race condition in Linux KVM with PV TLB enabled allows guest processes to read memory from other processes in the same guest.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-3016?
CVE-2019-3016 is a medium-severity vulnerability in Linux kernel, published on 31 Jan 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.
Which versions are affected by CVE-2019-3016?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2019-3016?
Apply the vendor's patch.
Is CVE-2019-3016 being exploited?
There is no known exploitation of CVE-2019-3016 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-34852, AZL-6519, DEBIAN-CVE-2019-3016, GHSA-g7mw-cr59-r458, UBUNTU-CVE-2019-3016.