Bug 1789209 (CVE-2019-14615)
| Summary: | CVE-2019-14615 kernel: Intel graphics card information leak. | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Wade Mealing <wmealing> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | acaringi, airlied, bhu, blc, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jglisse, jlelli, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, mchehab, mcressma, mjg59, mlangsdo, nmurray, ppandit, qzhao, rt-maint, rvrbovsk, security-response-team, steved, williams |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
An information disclosure flaw was found in the Linux kernel. The i915 graphics driver lacks control of flow for data structures which may allow a local, authenticated user to disclose information when using ioctl commands with an attached i915 device. The highest threat from this vulnerability is to data confidentiality.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-04-22 04:16:22 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1790299, 1790300, 1790301, 1790320, 1791510, 1793118, 1793121, 1952322, 1973748 | ||
| Bug Blocks: | 1789712, 1790267 | ||
|
Description
Wade Mealing
2020-01-09 03:56:38 UTC
Mitigation: Preventing loading of the i915 kernel module will prevent attackers from using this exploit against the system; however, the power management functionality of the card will be disabled and the system may draw additional power. See the kcs “How do I blacklist a kernel module to prevent it from loading automatically?“ (https://access.redhat.com/solutions/41278) for instructions on how to disable a kernel module from autoloading. Graphical displays may also be at low resolution or not work correctly. This mitigation may not be suitable if the graphical login functionality is required. Upstream Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bc8a76a152c5f9ef3b48104154a65a68a8b76946 https://lists.freedesktop.org/archives/intel-gfx/2020-January/225945.html The upstream patch mentioned only fixes Skylake and above. The problem is also there on Ivybridge and Haswell, and the proposed upstream solutions are currently killing performance on those devices. Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1793118] Statement: This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7, 8 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 6, 7, and 8 may address this issue. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates of Red Hat Enterprise MRG 2. We have fixed this in all the Gen 9 Intel hardware. The upstream patches for Gen7 are quite intrusive and have had a number of follow on fixes in progress. I'm not comfortable shipping those in a Z stream update just to fix this for Gen 7 Intel hardware. These fixes will eventually be pulled in via our normal Y stream rebase process. (likely for 8.5). As such I'm closing this bug as I don't see us proceeding with the gen7 fixes at this stage outside of 8.Y stream. I've opened another bug for internal tracking of the Y stream backport. Ok, I think we can close this up. |