The fix for CVE-2019-14615 to address the Linux kernel not properly clearing data structures on context switches for certain Intel graphics processors was incomplete. A local attacker could use this to expose sensitive information. https://lists.ubuntu.com/archives/kernel-team/2020-February/107444.html
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1817048]
Mitigation: Preventing loading of the i915 kernel module will prevent attackers from using this exploit against the system; however, the power management functionality of the card will be disabled and the system may draw additional power. See the kcs “How do I blacklist a kernel module to prevent it from loading automatically?“ (https://access.redhat.com/solutions/41278) for instructions on how to disable a kernel module from autoloading. Graphical displays may also be at low resolution or not work correctly. This mitigation may not be suitable if the graphical login functionality is required.
This flaw is rated as moderate, it appears to only leak graphic shader context, not screen contents. Unlike the previous CVE, this fix is not valid at this point in Red Hat Enterprise Linux 6's lifecycle.
This dosen't apply to us as we are not going to close the original bug for that hardware until 8.5 Y stream.
Ok closing up, since we're considering this fixed for the releases. Older hardware fixes will filter in on 8.5