CVE-2019-19602
MEDIUM
6,1
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: low
MEDIUM
5,4
Source: [email protected]
Access Vector: local
Access Complexity: medium
Authentication: none
Confidentiality: complete
Integrity: none
Availability: partial
Description
AI Translation Available
fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact because of incorrect fpu_fpregs_owner_ctx caching, as demonstrated by mishandling of signal-based non-cooperative preemption in Go 1.14 prereleases on amd64, aka CID-59c4bd853abc.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0003
Percentile
0,1th
Updated
EPSS Score Trend (Last 90 Days)
119
Improper Restriction of Operations within the Bounds of a Memory Buffer
StableCommon Consequences
Security Scopes Affected:
Integrity
Confidentiality
Availability
Potential Impacts:
Execute Unauthorized Code Or Commands
Modify Memory
Read Memory
Dos: Crash, Exit, Or Restart
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Applicable Platforms
Languages:
Assembly, C, C++, Memory-Unsafe
Operating System
Ubuntu Linux by Canonical
CPE Identifier
View Detailed Analysis
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Ubuntu Linux by Canonical
CPE Identifier
View Detailed Analysis
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Linux Kernel by Linux
Version Range Affected
To
5.4.2
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://bugzilla.kernel.org/show_bug.cgi?id=205663
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.2
https://github.com/golang/go/issues/35777#issuecomment-561935388
https://github.com/torvalds/linux/commit/59c4bd853abcea95eccc167a7d7fd5f1a5f47b…
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=59c4…
https://security.netapp.com/advisory/ntap-20200103-0001/
https://usn.ubuntu.com/4284-1/
https://bugzilla.kernel.org/show_bug.cgi?id=205663
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.2
https://github.com/golang/go/issues/35777#issuecomment-561935388
https://github.com/torvalds/linux/commit/59c4bd853abcea95eccc167a7d7fd5f1a5f47b…
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=59c4…
https://security.netapp.com/advisory/ntap-20200103-0001/
https://usn.ubuntu.com/4284-1/