In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via an interrupt. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process, because MSRTMACTIVE is misused in arch/powerpc/kernel/process.c.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15031.json"
[
{
"id": "CVE-2019-15031-3d957649",
"signature_type": "Function",
"digest": {
"function_hash": "297915405749110588448973457154909498921",
"length": 65.0
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a8318c13e79badb92bc6640704a64cc022a6eb97",
"target": {
"function": "tm_active_with_altivec",
"file": "arch/powerpc/kernel/process.c"
},
"deprecated": false
},
{
"id": "CVE-2019-15031-5a0fccf6",
"signature_type": "Function",
"digest": {
"function_hash": "105089194084059190765727274466269886596",
"length": 269.0
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a8318c13e79badb92bc6640704a64cc022a6eb97",
"target": {
"function": "restore_altivec",
"file": "arch/powerpc/kernel/process.c"
},
"deprecated": false
},
{
"id": "CVE-2019-15031-7a10bd9b",
"signature_type": "Function",
"digest": {
"function_hash": "297915405749110588448973457154909498921",
"length": 65.0
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a8318c13e79badb92bc6640704a64cc022a6eb97",
"target": {
"function": "tm_active_with_fp",
"file": "arch/powerpc/kernel/process.c"
},
"deprecated": false
},
{
"id": "CVE-2019-15031-84179305",
"signature_type": "Function",
"digest": {
"function_hash": "52926210787788187713927832685079932178",
"length": 145.0
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a8318c13e79badb92bc6640704a64cc022a6eb97",
"target": {
"function": "tm_active_with_fp",
"file": "arch/powerpc/kernel/process.c"
},
"deprecated": false
},
{
"id": "CVE-2019-15031-91338f98",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"16844821952910704619490884818014260942",
"293531244642398349632822560373355213765",
"109131402512626204835141205017338588263",
"134033744487781350146301843169717282937",
"141477434691695882788134718674812971032",
"115248294462158842821277763419703851451",
"223865500898763186521587723155643861619",
"39600711809707185299125592240168707130",
"66129596845126268962098343424384087985",
"141309864461213873496365746431832680893",
"37197993907492497537473876339115907803",
"96366418647508746139724193445932792979",
"193126932114142045703671182307947553739",
"10490935588422641520341804727005166414",
"52362817239080695863209935332088653563",
"312753708929000563096377641060372337320",
"29251923430221345526916098354378960896",
"56581461580854530119352336260842470905",
"111532615355135817519018205356600439117",
"28702752991477682896447094778306653551",
"60423011204116267983443933088220755097",
"108852802509285339548854624250344529083",
"255460236114784088469143592173001344712",
"332560853253513459018366795726159463585",
"70772795159044757736567946963012306469",
"170079577886781768878473272748900808595"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a8318c13e79badb92bc6640704a64cc022a6eb97",
"target": {
"file": "arch/powerpc/kernel/process.c"
},
"deprecated": false
},
{
"id": "CVE-2019-15031-dc70eaa0",
"signature_type": "Function",
"digest": {
"function_hash": "309550320929064221506856239875615816385",
"length": 203.0
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a8318c13e79badb92bc6640704a64cc022a6eb97",
"target": {
"function": "restore_fp",
"file": "arch/powerpc/kernel/process.c"
},
"deprecated": false
},
{
"id": "CVE-2019-15031-ff11c430",
"signature_type": "Function",
"digest": {
"function_hash": "257549269920897733263609895367131006689",
"length": 146.0
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a8318c13e79badb92bc6640704a64cc022a6eb97",
"target": {
"function": "tm_active_with_altivec",
"file": "arch/powerpc/kernel/process.c"
},
"deprecated": false
}
]