Bug 1724398 (CVE-2019-0155) - CVE-2019-0155 hw: Intel GPU blitter manipulation can allow for arbitrary kernel memory write
Summary: CVE-2019-0155 hw: Intel GPU blitter manipulation can allow for arbitrary kern...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-0155
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1756866 1756871 1756873 1756874 1756876 1756877 1756878 1756879 1756880 1756881 1756882 1756883 1756888 1756889 1756890 1756891 1756892 1756893 1756894 1756895 1760666 1760667 1760672 1767737 1771644
Blocks: 1724392
TreeView+ depends on / blocked
 
Reported: 2019-06-27 01:33 UTC by Wade Mealing
Modified: 2020-03-24 13:21 UTC (History)
58 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Intel graphics hardware (GPU), where a local attacker with the ability to issue commands to the GPU could inadvertently lead to memory corruption and possible privilege escalation. The attacker could use the GPU blitter to perform privilege MMIO operations, not limited to the address space required to function correctly.
Clone Of:
Environment:
Last Closed: 2019-11-13 18:51:11 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2019:3894 None None None 2019-11-18 10:49:30 UTC
Red Hat Product Errata RHBA-2019:3900 None None None 2019-11-18 12:57:37 UTC
Red Hat Product Errata RHBA-2019:3909 None None None 2019-11-19 10:28:31 UTC
Red Hat Product Errata RHBA-2019:3910 None None None 2019-11-19 11:04:16 UTC
Red Hat Product Errata RHBA-2019:4121 None None None 2019-12-10 00:30:54 UTC
Red Hat Product Errata RHBA-2019:4196 None None None 2019-12-10 19:44:03 UTC
Red Hat Product Errata RHBA-2019:4197 None None None 2019-12-10 19:42:21 UTC
Red Hat Product Errata RHSA-2019:3870 None None None 2019-11-13 16:37:31 UTC
Red Hat Product Errata RHSA-2019:3871 None None None 2019-11-13 16:53:01 UTC
Red Hat Product Errata RHSA-2019:3872 None None None 2019-11-13 18:53:04 UTC
Red Hat Product Errata RHSA-2019:3873 None None None 2019-11-13 18:36:18 UTC
Red Hat Product Errata RHSA-2019:3877 None None None 2019-11-13 19:23:29 UTC
Red Hat Product Errata RHSA-2019:3878 None None None 2019-11-13 20:17:02 UTC
Red Hat Product Errata RHSA-2019:3883 None None None 2019-11-14 08:31:44 UTC
Red Hat Product Errata RHSA-2019:3887 None None None 2019-11-14 17:22:12 UTC
Red Hat Product Errata RHSA-2019:3889 None None None 2019-11-14 17:48:32 UTC
Red Hat Product Errata RHSA-2019:3908 None None None 2019-11-19 09:42:53 UTC
Red Hat Product Errata RHSA-2020:0204 None None None 2020-01-22 21:24:56 UTC

Description Wade Mealing 2019-06-27 01:33:13 UTC
A flaw was found in Intel graphics hardware (GPU) where a local attacker with the ability to issue commands to the GPU which could inadvertently lead to memory corruption and possibly privilege escalation.

The attacker could use the GPU blitter to perform privilege MMIO operations not limited to the address space required to function correctly.  This would expose the blitter to access kernel memory with a specially crafted request to the blitter.

Affected hardware:

- Ivy Bridge(Gen 7) and later, 
- Cherry Trail (Gen8) and newer mobile, desktop and embedded processors.
- Intel Xeon E3-1200 v4 and later product families.

Comment 31 Petr Matousek 2019-11-12 09:43:47 UTC
Mitigation:

Preventing loading of the i915 kernel module will prevent attackers from using this exploit against the system however the power management functionality of the card will be disabled and the system may draw additional power. See this KCS article( https://access.redhat.com/solutions/41278 ) for instructions on how to disable a kernel module. Graphical displays may also be at low resolution or not work correctly. This mitigation may not be suitable if running graphical tools locally is required.

Comment 32 Petr Matousek 2019-11-12 09:45:04 UTC
Statement:

Red Hat Product Security is aware of this issue. Updates will be released as they become available. For additional information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/solutions/i915-graphics

Comment 34 Wade Mealing 2019-11-12 09:50:53 UTC
Acknowledgments:

Name: Intel

Comment 35 Petr Matousek 2019-11-12 18:06:45 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1771644]

Comment 37 errata-xmlrpc 2019-11-13 16:37:28 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:3870 https://access.redhat.com/errata/RHSA-2019:3870

Comment 38 errata-xmlrpc 2019-11-13 16:52:58 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:3871 https://access.redhat.com/errata/RHSA-2019:3871

Comment 39 errata-xmlrpc 2019-11-13 18:36:15 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Extended Update Support

Via RHSA-2019:3873 https://access.redhat.com/errata/RHSA-2019:3873

Comment 40 Product Security DevOps Team 2019-11-13 18:51:11 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-0155

Comment 41 errata-xmlrpc 2019-11-13 18:53:01 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:3872 https://access.redhat.com/errata/RHSA-2019:3872

Comment 42 errata-xmlrpc 2019-11-13 19:23:27 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Advanced Update Support
  Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.4 Telco Extended Update Support

Via RHSA-2019:3877 https://access.redhat.com/errata/RHSA-2019:3877

Comment 43 errata-xmlrpc 2019-11-13 20:16:58 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2019:3878 https://access.redhat.com/errata/RHSA-2019:3878

Comment 44 errata-xmlrpc 2019-11-14 08:31:40 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Telco Extended Update Support
  Red Hat Enterprise Linux 7.3 Advanced Update Support
  Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions

Via RHSA-2019:3883 https://access.redhat.com/errata/RHSA-2019:3883

Comment 45 errata-xmlrpc 2019-11-14 17:22:09 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:3887 https://access.redhat.com/errata/RHSA-2019:3887

Comment 46 errata-xmlrpc 2019-11-14 17:48:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.5 Extended Update Support

Via RHSA-2019:3889 https://access.redhat.com/errata/RHSA-2019:3889

Comment 48 errata-xmlrpc 2019-11-19 09:42:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise MRG 2

Via RHSA-2019:3908 https://access.redhat.com/errata/RHSA-2019:3908

Comment 57 errata-xmlrpc 2020-01-22 21:24:54 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:0204 https://access.redhat.com/errata/RHSA-2020:0204


Note You need to log in before you can comment on or make changes to this bug.