CVE-2019-15902
Description
A backporting error was discovered in the Linux stable/longterm kernel 4.4.x through 4.4.190, 4.9.x through 4.9.190, 4.14.x through 4.14.141, 4.19.x through 4.19.69, and 5.2.x through 5.2.11. Misuse of the upstream "x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()" commit reintroduced the Spectre vulnerability that it aimed to eliminate. This occurred because the backport process depends on cherry picking specific commits, and because two (correctly ordered) code lines were swapped.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2019-15902
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2019-15902.html
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| debian | bookworm | fixed | 5.2.17-1 |
| debian | bullseye | fixed | 5.2.17-1 |
| debian | forky | fixed | 5.2.17-1 |
| debian | sid | fixed | 5.2.17-1 |
| debian | trixie | fixed | 5.2.17-1 |
References
Verify integrity in audit chain (admin only). AS-IS.