CVE-2019-3887

A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0’s APIC register values via L2 guest, when ‘virtualize x2APIC mode’ is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue.

From the Ubuntu Security Team

Marc Orr discovered that the KVM hypervisor implementation in the Linux kernel did not properly restrict APIC MSR register values when nested virtualization is used. An attacker in a guest vm could use this to cause a denial of service (host OS crash).

Read the notes from the security team

Mitigation

If qemu is installed, to prevent nested virtualization from being enabled, set “options kvm_intel nested=0” in /etc/modprobe.d/qemu-system-x86.conf

Status

Show unmaintained releases

Package	Ubuntu Release	Status
linux	19.04 disco	Fixed 5.0.0-15.16
	18.10 cosmic	Fixed 4.18.0-20.21
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected
linux-aws	19.04 disco	Fixed 5.0.0-1006.6
	18.10 cosmic	Fixed 4.18.0-1016.18
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected
linux-aws-hwe	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-azure	19.04 disco	Fixed 5.0.0-1006.6
	18.10 cosmic	Fixed 4.18.0-1018.18
	18.04 LTS bionic	Fixed 4.18.0-1018.18~18.04.1
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected
linux-azure-edge	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Fixed 4.18.0-1018.18~18.04.1
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-euclid	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-flo	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Ignored abandoned
	14.04 LTS trusty	Not in release
linux-gcp	19.04 disco	Fixed 5.0.0-1006.6
	18.10 cosmic	Fixed 4.18.0-1011.12
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-gcp-edge	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Fixed 4.18.0-1011.12~18.04.1
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-gke	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Ignored end of standard support
	14.04 LTS trusty	Not in release
linux-goldfish	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Ignored end of life
	14.04 LTS trusty	Not in release
linux-grouper	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-hwe	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Fixed 4.18.0-20.21~18.04.1
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-hwe-edge	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-kvm	19.04 disco	Fixed 5.0.0-1006.6
	18.10 cosmic	Fixed 4.18.0-1012.12
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-lts-trusty	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-lts-utopic	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Ignored end of life, was ignored
linux-lts-vivid	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Ignored end of life, was ignored
linux-lts-wily	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Ignored end of life, was ignored
linux-lts-xenial	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not affected
linux-maguro	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-mako	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Ignored abandoned
	14.04 LTS trusty	Not in release
linux-manta	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-oem	19.04 disco	Not affected
	18.10 cosmic	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Ignored end of standard support, was needs-triage
	14.04 LTS trusty	Not in release
linux-oracle	19.04 disco	Not affected
	18.10 cosmic	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-raspi2	19.04 disco	Fixed 5.0.0-1008.8
	18.10 cosmic	Fixed 4.18.0-1014.16
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-snapdragon	19.04 disco	Fixed 5.0.0-1012.12
	18.10 cosmic	Not in release
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release

Notes

tyhicks

Ubuntu kernels do not enable nested KVM virtualization by default and are unaffected by this flaw in the default configuration. However, installing QEMU results in nested KVM support to be enabled via the /etc/modprobe.d/qemu-system-x86.conf file. To ensure that nested virtualization is not enabled, verify that the /sys/module/kvm_intel/parameters/nested file contains “N”.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
linux	Introduced by 15303ba, fixed by acff784 Introduced by c992384, fixed by c73f4c9

Severity score breakdown

Parameter	Value
Base score	5.6 · Medium
Attack vector	Local
Attack complexity	High
Privileges required	Low
User interaction	None
Scope	Changed
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

References

Related Ubuntu Security Notices (USN)

USN-3980-1
Linux kernel vulnerabilities
14 May 2019

USN-3980-2
Linux kernel (HWE) vulnerabilities
14 May 2019

USN-3979-1
Linux kernel vulnerabilities
14 May 2019

Cvss 3 Severity Score