CVE-2019-3887

A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.6 MEDIUM
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
redhatCNA
6.7 MEDIUM
LOCAL
HIGH
HIGH
CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
VendorProductVersion
linuxlinux_kernel
4.16 ≤
canonicalubuntu_linux
18.04
canonicalubuntu_linux
18.10
canonicalubuntu_linux
19.04
redhatenterprise_linux
8.0
redhatenterprise_linux_eus
8.1
redhatenterprise_linux_eus
8.2
redhatenterprise_linux_eus
8.4
redhatenterprise_linux_for_real_time_for_nfv_tus
8.2
redhatenterprise_linux_for_real_time_for_nfv_tus
8.4
redhatenterprise_linux_for_real_time_tus
8.2
redhatenterprise_linux_for_real_time_tus
8.4
redhatenterprise_linux_server_aus
8.2
redhatenterprise_linux_server_aus
8.4
redhatenterprise_linux_server_tus
8.2
redhatenterprise_linux_server_tus
8.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
linux
bullseye
5.10.223-1
fixed
stretch
not-affected
jessie
not-affected
bullseye (security)
5.10.226-1
fixed
bookworm
6.1.106-3
fixed
bookworm (security)
6.1.112-1
fixed
trixie
6.11.5-1
fixed
sid
6.11.6-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux
disco
Fixed 5.0.0-15.16
released
cosmic
Fixed 4.18.0-20.21
released
bionic
not-affected
xenial
not-affected
trusty
not-affected
linux-aws
disco
Fixed 5.0.0-1006.6
released
cosmic
Fixed 4.18.0-1016.18
released
bionic
not-affected
xenial
not-affected
trusty
not-affected
linux-aws-hwe
disco
dne
cosmic
dne
bionic
dne
xenial
not-affected
trusty
dne
linux-azure
disco
Fixed 5.0.0-1006.6
released
cosmic
Fixed 4.18.0-1018.18
released
bionic
Fixed 4.18.0-1018.18~18.04.1
released
xenial
not-affected
trusty
not-affected
linux-azure-edge
disco
dne
cosmic
dne
bionic
Fixed 4.18.0-1018.18~18.04.1
released
xenial
not-affected
trusty
dne
linux-euclid
disco
dne
cosmic
dne
bionic
dne
xenial
not-affected
trusty
dne
linux-flo
disco
dne
cosmic
dne
bionic
dne
xenial
ignored
trusty
dne
linux-gcp
disco
Fixed 5.0.0-1006.6
released
cosmic
Fixed 4.18.0-1011.12
released
bionic
not-affected
xenial
not-affected
trusty
dne
linux-gcp-edge
disco
dne
cosmic
dne
bionic
Fixed 4.18.0-1011.12~18.04.1
released
xenial
dne
trusty
dne
linux-gke
disco
dne
cosmic
dne
bionic
not-affected
xenial
ignored
trusty
dne
linux-goldfish
disco
dne
cosmic
dne
bionic
dne
xenial
ignored
trusty
dne
linux-grouper
disco
dne
cosmic
dne
bionic
dne
xenial
dne
trusty
dne
linux-hwe
disco
dne
cosmic
dne
bionic
Fixed 4.18.0-20.21~18.04.1
released
xenial
not-affected
trusty
dne
linux-hwe-edge
disco
dne
cosmic
dne
bionic
not-affected
xenial
not-affected
trusty
dne
linux-kvm
disco
Fixed 5.0.0-1006.6
released
cosmic
Fixed 4.18.0-1012.12
released
bionic
not-affected
xenial
not-affected
trusty
dne
linux-lts-trusty
disco
dne
cosmic
dne
bionic
dne
xenial
dne
trusty
dne
linux-lts-utopic
disco
dne
cosmic
dne
bionic
dne
xenial
dne
trusty
ignored
linux-lts-vivid
disco
dne
cosmic
dne
bionic
dne
xenial
dne
trusty
ignored
linux-lts-wily
disco
dne
cosmic
dne
bionic
dne
xenial
dne
trusty
ignored
linux-lts-xenial
disco
dne
cosmic
dne
bionic
dne
xenial
dne
trusty
not-affected
linux-maguro
disco
dne
cosmic
dne
bionic
dne
xenial
dne
trusty
dne
linux-mako
disco
dne
cosmic
dne
bionic
dne
xenial
ignored
trusty
dne
linux-manta
disco
dne
cosmic
dne
bionic
dne
xenial
dne
trusty
dne
linux-oem
disco
not-affected
cosmic
not-affected
bionic
not-affected
xenial
ignored
trusty
dne
linux-oracle
disco
not-affected
cosmic
not-affected
bionic
not-affected
xenial
not-affected
trusty
dne
linux-raspi2
disco
Fixed 5.0.0-1008.8
released
cosmic
Fixed 4.18.0-1014.16
released
bionic
not-affected
xenial
not-affected
trusty
dne
linux-snapdragon
disco
Fixed 5.0.0-1012.12
released
cosmic
dne
bionic
not-affected
xenial
not-affected
trusty
dne
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/107850
https://access.redhat.com/errata/RHSA-2019:2703
https://access.redhat.com/errata/RHSA-2019:2741
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3887
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWPOIII2L73HV5PGXSGMRMKQIK47UIYE/
https://usn.ubuntu.com/3979-1/
https://usn.ubuntu.com/3980-1/
https://usn.ubuntu.com/3980-2/
http://www.securityfocus.com/bid/107850
https://access.redhat.com/errata/RHSA-2019:2703
https://access.redhat.com/errata/RHSA-2019:2741
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3887
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWPOIII2L73HV5PGXSGMRMKQIK47UIYE/
https://usn.ubuntu.com/3979-1/
https://usn.ubuntu.com/3980-1/
https://usn.ubuntu.com/3980-2/