CVE-2019-1125

Published: 6 August 2019

An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1071, CVE-2019-1073.

From the Ubuntu Security Team

Andrei Vlad Lutas and Dan Lutas discovered that some x86 processors incorrectly handle SWAPGS instructions during speculative execution. A local attacker could use this to expose sensitive information (kernel memory).

Notes

This issue is not believed to be exploitable in the Linux kernel but
kernel updates will be made available to ensure that it cannot be exploited
Kernel updates will soon be available for testing in the Proposed
pocket and they are expected to be officially released on August 12th
See the following page if you'd like to test the patched kernels from
the Proposed pocket: https://wiki.ubuntu.com/Testing/EnableProposed

Priority

Medium

CVSS 3 base score: 5.5

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1125
• https://www.bitdefender.com/business/swapgs-attack.html
• https://ubuntu.com/security/notices/USN-4093-1
• https://ubuntu.com/security/notices/USN-4094-1
• https://ubuntu.com/security/notices/USN-4095-1
• https://ubuntu.com/security/notices/USN-4095-2
• https://ubuntu.com/security/notices/USN-4096-1
• NVD
• Launchpad
• Debian