CVE-2019-19332

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 3.13 through 5.4

Description An out-of-bounds memory write issue was found in the Linux Kernel's KVM hypervisor, related to the handling of the 'KVM GET EMULATED CPUID' ioctl(2) request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use this flaw to crash the system, resulting in a denial of service. The issue may also allow an attacker to compromise data integrity.

Recommendations For Linux Kernel versions 3.13 through 5.4, consider restricting access to the '/dev/kvm' device to minimize the risk of exploitation. As a temporary workaround, limiting the use of the KVM hypervisor's 'KVM GET EMULATED CPUID' ioctl(2) request may help mitigate the issue until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.