CVE-2019-14615

Published: 14 January 2020

Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor Graphics may allow an unauthenticated user to potentially enable information disclosure via local access.

From the Ubuntu Security Team

It was discovered that the Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors. A local attacker could use this to expose sensitive information.

Notes

This issue only affects systems with Intel Graphics Processing Units
(GPUs)
Gen8 Intel GPUs were previously fixed by commit 0160f055393f
("drm/i915/gen8: Add WaClearSlmSpaceAtContextSwitch workaround")
Fixes are only available for Gen8 and Gen9 GPUs at this time
Fixes for Gen6 and Gen7 may be available in the future

Priority

Medium

CVSS 3 base score: 5.5

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14615
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bc8a76a152c5f9ef3b48104154a65a68a8b76946
• https://ubuntu.com/security/notices/USN-4253-1
• https://ubuntu.com/security/notices/USN-4255-1
• https://ubuntu.com/security/notices/USN-4254-1
• https://ubuntu.com/security/notices/USN-4255-2
• https://ubuntu.com/security/notices/USN-4254-2
• https://ubuntu.com/security/notices/USN-4253-2
• https://ubuntu.com/security/notices/USN-4284-1
• https://ubuntu.com/security/notices/USN-4285-1
• https://ubuntu.com/security/notices/USN-4286-1
• https://ubuntu.com/security/notices/USN-4287-1
• https://ubuntu.com/security/notices/USN-4286-2
• https://ubuntu.com/security/notices/USN-4287-2
• NVD
• Launchpad
• Debian