CVE-2019-7221
Publication date 21 March 2019
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.
From the Ubuntu Security Team
Jim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code in the host system.
Status
Package | Ubuntu Release | Status |
---|---|---|
linux | ||
18.04 LTS bionic |
Fixed 4.15.0-47.50
|
|
16.04 LTS xenial |
Fixed 4.4.0-145.171
|
|
14.04 LTS trusty |
Not affected
|
|
linux-aws | ||
18.04 LTS bionic |
Fixed 4.15.0-1035.37
|
|
16.04 LTS xenial |
Fixed 4.4.0-1079.89
|
|
14.04 LTS trusty |
Fixed 4.4.0-1040.43
|
|
linux-aws-hwe | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial |
Fixed 4.15.0-1035.37~16.04.1
|
|
14.04 LTS trusty | Not in release | |
linux-azure | ||
18.04 LTS bionic |
Fixed 4.18.0-1014.14~18.04.1
|
|
16.04 LTS xenial |
Fixed 4.15.0-1041.45
|
|
14.04 LTS trusty |
Fixed 4.15.0-1041.45~14.04.1
|
|
linux-azure-edge | ||
18.04 LTS bionic |
Fixed 4.18.0-1014.14~18.04.1
|
|
16.04 LTS xenial |
Fixed 4.15.0-1041.45
|
|
14.04 LTS trusty | Not in release | |
linux-euclid | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Ignored | |
14.04 LTS trusty | Not in release | |
linux-flo | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Ignored | |
14.04 LTS trusty | Not in release | |
linux-gcp | ||
18.04 LTS bionic |
Fixed 4.15.0-1029.31
|
|
16.04 LTS xenial |
Fixed 4.15.0-1029.31~16.04.1
|
|
14.04 LTS trusty | Not in release | |
linux-gcp-edge | ||
18.04 LTS bionic |
Fixed 4.18.0-1008.9~18.04.1
|
|
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-gke | ||
18.04 LTS bionic |
Not affected
|
|
16.04 LTS xenial | Ignored | |
14.04 LTS trusty | Not in release | |
linux-goldfish | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Ignored | |
14.04 LTS trusty | Not in release | |
linux-grouper | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-hwe | ||
18.04 LTS bionic |
Fixed 4.18.0-17.18~18.04.1
|
|
16.04 LTS xenial |
Fixed 4.15.0-47.50~16.04.1
|
|
14.04 LTS trusty | Not in release | |
linux-hwe-edge | ||
18.04 LTS bionic |
Not affected
|
|
16.04 LTS xenial |
Fixed 4.15.0-47.50~16.04.1
|
|
14.04 LTS trusty | Not in release | |
linux-kvm | ||
18.04 LTS bionic |
Fixed 4.15.0-1031.31
|
|
16.04 LTS xenial |
Fixed 4.4.0-1043.49
|
|
14.04 LTS trusty | Not in release | |
linux-lts-trusty | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-lts-utopic | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Ignored | |
linux-lts-vivid | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Ignored | |
linux-lts-wily | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Ignored | |
linux-lts-xenial | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty |
Fixed 4.4.0-144.170~14.04.1
|
|
linux-maguro | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-mako | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Ignored | |
14.04 LTS trusty | Not in release | |
linux-manta | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-oem | ||
18.04 LTS bionic |
Fixed 4.15.0-1035.40
|
|
16.04 LTS xenial | Ignored | |
14.04 LTS trusty | Not in release | |
linux-oracle | ||
18.04 LTS bionic |
Fixed 4.15.0-1010.12
|
|
16.04 LTS xenial |
Fixed 4.15.0-1010.12~16.04.1
|
|
14.04 LTS trusty | Not in release | |
linux-raspi2 | ||
18.04 LTS bionic |
Fixed 4.15.0-1033.35
|
|
16.04 LTS xenial |
Fixed 4.4.0-1106.114
|
|
14.04 LTS trusty | Not in release | |
linux-snapdragon | ||
18.04 LTS bionic |
Fixed 4.15.0-1053.57
|
|
16.04 LTS xenial |
Fixed 4.4.0-1110.115
|
|
14.04 LTS trusty | Not in release |
Notes
tyhicks
Ubuntu kernels do not enable nested KVM virtualization by default and are unaffected by this flaw in the default configuration. However, installing QEMU results in nested KVM support to be enabled via the /etc/modprobe.d/qemu-system-x86.conf file. To ensure that nested virtualization is not enabled, verify that the /sys/module/kvm_intel/parameters/nested file contains "N".
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.8 · High |
Attack vector | Local |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-3932-1
- Linux kernel vulnerabilities
- 2 April 2019
- USN-3932-2
- Linux kernel (Xenial HWE) vulnerabilities
- 2 April 2019
- USN-3930-2
- Linux kernel (HWE) vulnerabilities
- 2 April 2019
- USN-3930-1
- Linux kernel vulnerabilities
- 2 April 2019
- USN-3931-2
- Linux kernel (HWE) vulnerabilities
- 2 April 2019
- USN-3931-1
- Linux kernel vulnerabilities
- 2 April 2019