CVE-2019-5489

Published: 7 January 2019

The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server.

Notes

On 2018-01-06, a potential fix for this issue was committed in the
upstream kernel git tree. The potential fix changes the behavior of the
mincore(2) system call in ways that could possibly break userspace
applications. The potential fix landed during the kernel's "merge window"
which allows for the change to mature and receive additional testing.
Applying the potential fix to Ubuntu kernels, at this time, could potentially
break some existing applications. Ubuntu will continue to monitor related
changes in the upstream kernel and evaluate/test the potential fix.

v1 fix was reverted. v2 of fix is now
134fca9063ad4851de767d1768180e5dede9a881

Status

Severity score breakdown

References

• https://www.openwall.com/lists/oss-security/2019/01/07/2
• https://arxiv.org/pdf/1901.01161.pdf
• https://lore.kernel.org/lkml/CAHk-=wiqbKEC5jUXr3ax+oUuiRrp=QMv_ZnUfO-SPv=UNJ-OTw@mail.gmail.com/
• https://lore.kernel.org/lkml/CAHk-=wg+C65FJHB=Jx1OvuJP4kvpWdw+5G=XOXB6X_KB2XuofA@mail.gmail.com/#t
• https://lore.kernel.org/lkml/nycvar.YFH.7.76.1901272335040.6626@cbobk.fhfr.pm/
• https://www.cve.org/CVERecord?id=CVE-2019-5489
• NVD
• Launchpad
• Debian