PT-2019-2625 · Linux+5 · Linux Kernel+5

Michael Ellerman · Published 2019-06-12 · Updated 2022-04-18 · CVE-2019-12817

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.1.15 for powerpc

Description The issue is related to a bug in the arch/powerpc/mm/mmu context book3s64.c component of the Linux kernel for powerpc systems. This bug allows unrelated processes to potentially read or write to each other's virtual memory under certain conditions, specifically when an mmap operation is performed above 512 TB. The vulnerability is caused by a buffer overflow in memory, which can be exploited to access or damage the memory content of other processes in the system using the mmap function.

Recommendations For Linux kernel versions prior to 5.1.15 for powerpc, update to version 5.1.15 or later to resolve the issue. As a temporary workaround, consider restricting the use of the mmap function above 512 TB to minimize the risk of exploitation.

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

ALT-PU-2019-2141

ALT-PU-2019-2200

ALT-PU-2019-2201

ALT-PU-2019-2314

ALT-PU-2020-1198

ALT-PU-2020-1501

ALT-PU-2020-2410

ALT-PU-2020-2433

ALT-PU-2021-1870

BDU:2019-02507

CESA-2019_2703

CVE-2019-12817

DSA-4495-1

MGASA-2019-0314

OPENSUSE-SU-2019:1757-1

OPENSUSE-SU-2019_1757-1

RHSA-2019:2703

RHSA-2019_2703

SUSE-SU-2019:1744-1

SUSE-SU-2019:1765-1

SUSE-SU-2019:1769-1

SUSE-SU-2019:2069-1

SUSE-SU-2019:2430-1

SUSE-SU-2019_1765-1

SUSE-SU-2019_1769-1

USN-4031-1

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

Ubuntu

References · 639

• https://nvd.nist.gov/vuln/detail/CVE-2019-12817 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:1765-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02507 · Security Note
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.15 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12817 · Vendor Advisory
• https://debian.org/security/2019/dsa-4495 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:1744-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-12817 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2069-1 · Vendor Advisory
• https://usn.ubuntu.com/4031-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12817 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OTLN3KQYEEWWAJYA4BUYYDMWWXCJQNV2 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0314.html · Security Note
• https://osv.dev/vulnerability/USN-4031-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00025.html · Vendor Advisory