CVE-2019-5489
Summary
| CVE | CVE-2019-5489 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-01-07 17:29:00 UTC |
| Updated | 2020-08-24 17:37:00 UTC |
| Description | The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server. |
Risk And Classification
Problem Types: CWE-319
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Linux | Linux Kernel | All | All | All | All |
| Application | Netapp | Active Iq Performance Analytics Services | - | All | All | All |
| Application | Netapp | Active Iq Performance Analytics Services | - | All | All | All |
| Application | Netapp | Element Software Management Node | - | All | All | All |
| Application | Netapp | Element Software Management Node | - | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Bugtraq: [SECURITY] [DSA 4465-1] linux security update | BUGTRAQ | seclists.org | |
| Change mincore() to count "mapped" pages rather than "cached" pages · torvalds/linux@574823b · GitHub | MISC | github.com | Patch, Third Party Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Oracle Critical Patch Update Advisory - July 2020 | MISC | www.oracle.com | |
| [security-announce] openSUSE-SU-2019:1570-1: important: Security update | SUSE | lists.opensuse.org | |
| [security-announce] openSUSE-SU-2019:1479-1: important: Security update | SUSE | lists.opensuse.org | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Bug 1120843 – VUL-0: CVE-2019-5489: kernel-source: new pagecache side-channel attack | MISC | bugzilla.suse.com | Issue Tracking, Patch, Third Party Advisory |
| Debian -- Security Information -- DSA-4465-1 linux | DEBIAN | www.debian.org | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Security Advisory - Page-Cache Side-Channel Vulnerability | CONFIRM | www.huawei.com | |
| kernel/git/torvalds/linux.git - Linux kernel source tree | MISC | git.kernel.org | Patch, Vendor Advisory |
| [SECURITY] [DLA 1823-1] linux security update | MLIST | lists.debian.org | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| New side-channel leak: Boffins bash operating system page caches until they spill secrets • The Register | MISC | www.theregister.co.uk | Technical Description, Third Party Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| CVE-2019-5489 Linux Kernel Vulnerability in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | Third Party Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| [SECURITY] [DLA 1824-1] linux-4.9 security update | MLIST | lists.debian.org | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Linux Kernel 'mm/mincore.c' Local Information Disclosure Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| [security-announce] openSUSE-SU-2019:1579-1: important: Security update | SUSE | lists.opensuse.org | |
| [1901.01161] Page Cache Attacks | MISC | arxiv.org | Third Party Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160525 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2023-12232)
- 296075 Oracle Solaris 11.4 Support Repository Update (SRU) 21.69.0 Missing (CPUAPR2020)
- 390276 Oracle VM Server for x86 Security Update for kernel (OVMSA-2023-0007)
- 610324 Google Android March 2021 Security Patch Missing for Huawei EMUI