CVE-2019-5489 json
The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patte…
published 2019-01-07 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-15064
- cvss
- 5.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server.
Patch / fix
- linux Debian 14, Debian 13, Debian 12 4.19.37-4
debian advisories DEBIAN-CVE-2019-5489
- linux Ubuntu 16.04 LTS 4.4.0-157.185
- linux Ubuntu 18.04 LTS 4.15.0-60.67
- linux-aws Ubuntu 16.04 LTS 4.4.0-1090.101
- linux-aws Ubuntu 18.04 LTS 4.15.0-1047.49
- linux-gcp Ubuntu 16.04 LTS 4.15.0-1041.43
- linux-gcp Ubuntu 18.04 LTS 4.15.0-1042.45
- linux-hwe Ubuntu 16.04 LTS 4.15.0-60.67~16.04.1
- linux-hwe Ubuntu 18.04 LTS 5.0.0-25.26~18.04.1
ubuntu advisories UBUNTU-CVE-2019-5489
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kernel RHEL 8 4.18.0-147.el8
- perf RHEL 8 4.18.0-147.el8
- bpftool RHEL 8 4.18.0-147.el8
- kernel-core RHEL 8 4.18.0-147.el8
- kernel-tools RHEL 8 4.18.0-147.el8
- python3-perf RHEL 8 4.18.0-147.el8
- kernel-modules RHEL 8 4.18.0-147.el8
- kernel-zfcpdump RHEL 8 4.18.0-147.el8
red hat advisories RHSA-2019:3517RHSA-2019:2029RHSA-2019:3309RHSA-2020:0204RHSA-2019:3967RHSA-2019:4058
- kernel-source-rt Real Time Module 15 SP1 4.12.14-14.8.1
- kernel-rt Real Time Module 15 SP1 4.12.14-14.8.1
- kernel-syms-rt Real Time Module 15 SP1 4.12.14-14.8.1
- kernel-rt_debug Real Time Module 15 SP1 4.12.14-14.8.1
- kernel-ec2 SLE Module for Public Cloud 12 3.12.61-52.154.1
- kernel-syms SLE Module for Development Tools 15 SP1 4.12.14-197.4.1
- kernel-source SLE Module for Development Tools 15 SP1, SLE Module for Basesystem 15 SP1 4.12.14-197.4.1
- kernel-default SLE Workstation Extension 15 SP1, SLE Module for Legacy 15 SP1, SLE Module for Basesystem 15 SP1 +2 more 4.12.14-197.4.1
suse advisories SUSE-SU-2019:2430-1SUSE-SU-2019:1692-1SUSE-SU-2019:1550-1SUSE-SU-2019:14089-1SUSE-SU-2019:1536-1SUSE-SU-2019:1535-1
- kernel-syms openSUSE Leap 15.0 4.12.14-lp150.12.64.1
- kernel-obs-qa openSUSE Leap 15.0 4.12.14-lp150.12.64.1
- kernel-source openSUSE Leap 15.0 4.12.14-lp150.12.64.1
- kernel-default openSUSE Leap 15.0 4.12.14-lp150.12.64.1
- kernel-vanilla openSUSE Leap 15.0 4.12.14-lp150.12.64.1
- kernel-kvmsmall openSUSE Leap 15.0 4.12.14-lp150.12.64.1
- kernel-obs-build openSUSE Leap 15.0 4.12.14-lp150.12.64.1
- kernel-syms openSUSE Leap 15.1 4.12.14-lp151.28.4.1
opensuse advisories openSUSE-SU-2019:1579-1openSUSE-SU-2019:1479-1
- linux Arch Linux 5.0.arch1-1
arch linux advisories AVG-842
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2019-5489 updated cvss 7.1
Kernel: page cache side channel attacks
-
Red Hat CodeReady Linux Builder (v. 8) kernel-debuginfo-common-x86_64 4.18.0-147.el8, kernel-debuginfo-common-aarch64 4.18.0-147.el8, kernel-debuginfo-common-ppc64le 4.18.0-147.el8 Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-147.el8, kernel 4.18.0-147.el8, bpftool 4.18.0-147.el8, kernel-core 4.18.0-147.el8, kernel-tools 4.18.0-147.el8, python3-perf 4.18.0-147.el8, +15 morefixed: vendor fix RHSA-2019:3517
-
Red Hat Enterprise Linux BaseOS E4S (v. 8.0) perf 4.18.0-80.15.1.el8_0, kernel 4.18.0-80.15.1.el8_0, bpftool 4.18.0-80.15.1.el8_0, kernel-core 4.18.0-80.15.1.el8_0, kernel-tools 4.18.0-80.15.1.el8_0, python3-perf 4.18.0-80.15.1.el8_0, +9 morefixed: vendor fix RHSA-2020:0204
-
Red Hat Enterprise Linux Client (v. 7) perf 3.10.0-1062.el7, kernel 3.10.0-1062.el7, bpftool 3.10.0-1062.el7, python-perf 3.10.0-1062.el7, kernel-tools 3.10.0-1062.el7, kernel-tools-libs 3.10.0-1062.el7, +2 more Red Hat Enterprise Linux Client Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1062.el7 Red Hat Enterprise Linux ComputeNode (v. 7) perf 3.10.0-1062.el7, kernel 3.10.0-1062.el7, bpftool 3.10.0-1062.el7, python-perf 3.10.0-1062.el7, kernel-tools 3.10.0-1062.el7, kernel-tools-libs 3.10.0-1062.el7, +2 morefixed: vendor fix RHSA-2019:2029
-
Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) perf 3.10.0-862.44.2.el7, kernel 3.10.0-862.44.2.el7, python-perf 3.10.0-862.44.2.el7, kernel-tools 3.10.0-862.44.2.el7, kernel-tools-libs 3.10.0-862.44.2.el7, kernel-abi-whitelists 3.10.0-862.44.2.el7, +1 morefixed: vendor fix RHSA-2019:3967
-
Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) perf 3.10.0-957.35.1.el7, kernel 3.10.0-957.35.1.el7, bpftool 3.10.0-957.35.1.el7, python-perf 3.10.0-957.35.1.el7, kernel-tools 3.10.0-957.35.1.el7, kernel-tools-libs 3.10.0-957.35.1.el7, +2 morefixed: vendor fix RHSA-2019:2837
-
Red Hat Enterprise Linux ComputeNode Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1062.el7fixed: vendor fix RHSA-2019:2029
-
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) kernel-debuginfo-common-x86_64 3.10.0-862.44.2.el7fixed: vendor fix RHSA-2019:3967
-
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) kernel-debuginfo-common-x86_64 3.10.0-957.35.1.el7fixed: vendor fix RHSA-2019:2837
show 24 moreshow fewer
-
Red Hat Enterprise Linux Desktop (v. 6) perf 2.6.32-754.18.2.el6, kernel 2.6.32-754.18.2.el6, kernel-firmware 2.6.32-754.18.2.el6, kernel-abi-whitelists 2.6.32-754.18.2.el6, kernel-debuginfo-common-i686 2.6.32-754.18.2.el6, kernel-debuginfo-common-x86_64 2.6.32-754.18.2.el6 Red Hat Enterprise Linux Desktop Optional (v. 6) python-perf 2.6.32-754.18.2.el6, kernel-debuginfo-common-i686 2.6.32-754.18.2.el6, kernel-debuginfo-common-x86_64 2.6.32-754.18.2.el6fixed: vendor fix RHSA-2019:2473
-
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) perf 4.14.0-115.12.1.el7a, kernel 4.14.0-115.12.1.el7a, kernel-alt 4.14.0-115.12.1.el7a, python-perf 4.14.0-115.12.1.el7a, kernel-tools 4.14.0-115.12.1.el7a, kernel-tools-libs 4.14.0-115.12.1.el7a, +3 more Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) kernel-debuginfo-common-ppc64le 4.14.0-115.12.1.el7afixed: vendor fix RHSA-2019:2809
-
Red Hat Enterprise Linux for Real Time (v. 7) kernel-rt 3.10.0-1062.rt56.1022.el7, kernel-rt-trace 3.10.0-1062.rt56.1022.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1062.rt56.1022.el7 Red Hat Enterprise Linux for Real Time for NFV (v. 7) kernel-rt 3.10.0-1062.rt56.1022.el7, kernel-rt-kvm 3.10.0-1062.rt56.1022.el7, kernel-rt-trace 3.10.0-1062.rt56.1022.el7, kernel-rt-debug-kvm 3.10.0-1062.rt56.1022.el7, kernel-rt-trace-kvm 3.10.0-1062.rt56.1022.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1062.rt56.1022.el7fixed: vendor fix RHSA-2019:2043
-
Red Hat Enterprise Linux HPC Node (v. 6) perf 2.6.32-754.18.2.el6, kernel 2.6.32-754.18.2.el6, kernel-firmware 2.6.32-754.18.2.el6, kernel-abi-whitelists 2.6.32-754.18.2.el6, kernel-debuginfo-common-i686 2.6.32-754.18.2.el6, kernel-debuginfo-common-x86_64 2.6.32-754.18.2.el6 Red Hat Enterprise Linux HPC Node Optional (v. 6) python-perf 2.6.32-754.18.2.el6, kernel-debuginfo-common-x86_64 2.6.32-754.18.2.el6fixed: vendor fix RHSA-2019:2473
-
Red Hat Enterprise Linux Real Time (v. 8) kernel-rt 4.18.0-147.rt24.93.el8, kernel-rt-core 4.18.0-147.rt24.93.el8, kernel-rt-modules 4.18.0-147.rt24.93.el8, kernel-rt-debug-core 4.18.0-147.rt24.93.el8, kernel-rt-debug-modules 4.18.0-147.rt24.93.el8, kernel-rt-modules-extra 4.18.0-147.rt24.93.el8, +2 more Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt 4.18.0-147.rt24.93.el8, kernel-rt-kvm 4.18.0-147.rt24.93.el8, kernel-rt-core 4.18.0-147.rt24.93.el8, kernel-rt-modules 4.18.0-147.rt24.93.el8, kernel-rt-debug-kvm 4.18.0-147.rt24.93.el8, kernel-rt-debug-core 4.18.0-147.rt24.93.el8, +4 morefixed: vendor fix RHSA-2019:3309
-
Red Hat Enterprise Linux Server (v. 5 ELS) kernel 2.6.18-439.el5, kernel-PAE 2.6.18-439.el5, kernel-xen 2.6.18-439.el5, kernel-kdump 2.6.18-439.el5, kernel-debuginfo-common 2.6.18-439.el5fixed: vendor fix RHSA-2019:2808
-
Red Hat Enterprise Linux Server (v. 6) perf 2.6.32-754.18.2.el6, kernel 2.6.32-754.18.2.el6, kernel-kdump 2.6.32-754.18.2.el6, kernel-firmware 2.6.32-754.18.2.el6, kernel-bootwrapper 2.6.32-754.18.2.el6, kernel-abi-whitelists 2.6.32-754.18.2.el6, +4 morefixed: vendor fix RHSA-2019:2473
-
Red Hat Enterprise Linux Server (v. 7) perf 3.10.0-1062.el7, kernel 3.10.0-1062.el7, bpftool 3.10.0-1062.el7, python-perf 3.10.0-1062.el7, kernel-kdump 3.10.0-1062.el7, kernel-tools 3.10.0-1062.el7, +7 morefixed: vendor fix RHSA-2019:2029
-
Red Hat Enterprise Linux Server AUS (v. 6.5) perf 2.6.32-431.97.1.el6, kernel 2.6.32-431.97.1.el6, kernel-firmware 2.6.32-431.97.1.el6, kernel-abi-whitelists 2.6.32-431.97.1.el6, kernel-debuginfo-common-x86_64 2.6.32-431.97.1.el6fixed: vendor fix RHSA-2019:4056
-
Red Hat Enterprise Linux Server AUS (v. 6.6) perf 2.6.32-504.82.1.el6, kernel 2.6.32-504.82.1.el6, kernel-firmware 2.6.32-504.82.1.el6, kernel-abi-whitelists 2.6.32-504.82.1.el6, kernel-debuginfo-common-x86_64 2.6.32-504.82.1.el6fixed: vendor fix RHSA-2019:4255
-
Red Hat Enterprise Linux Server AUS (v. 7.2) perf 3.10.0-327.83.1.el7, kernel 3.10.0-327.83.1.el7, python-perf 3.10.0-327.83.1.el7, kernel-tools 3.10.0-327.83.1.el7, kernel-tools-libs 3.10.0-327.83.1.el7, kernel-abi-whitelists 3.10.0-327.83.1.el7, +1 morefixed: vendor fix RHSA-2019:4164
-
Red Hat Enterprise Linux Server AUS (v. 7.3) perf 3.10.0-514.71.1.el7, kernel 3.10.0-514.71.1.el7, python-perf 3.10.0-514.71.1.el7, kernel-tools 3.10.0-514.71.1.el7, kernel-tools-libs 3.10.0-514.71.1.el7, kernel-abi-whitelists 3.10.0-514.71.1.el7, +1 morefixed: vendor fix RHSA-2019:4159
-
Red Hat Enterprise Linux Server AUS (v. 7.4) perf 3.10.0-693.61.1.el7, kernel 3.10.0-693.61.1.el7, python-perf 3.10.0-693.61.1.el7, kernel-tools 3.10.0-693.61.1.el7, kernel-tools-libs 3.10.0-693.61.1.el7, kernel-abi-whitelists 3.10.0-693.61.1.el7, +1 morefixed: vendor fix RHSA-2019:4058
-
Red Hat Enterprise Linux Server E4S (v. 7.2) perf 3.10.0-327.83.1.el7, kernel 3.10.0-327.83.1.el7, python-perf 3.10.0-327.83.1.el7, kernel-tools 3.10.0-327.83.1.el7, kernel-tools-libs 3.10.0-327.83.1.el7, kernel-abi-whitelists 3.10.0-327.83.1.el7, +1 morefixed: vendor fix RHSA-2019:4164
-
Red Hat Enterprise Linux Server E4S (v. 7.3) perf 3.10.0-514.71.1.el7, kernel 3.10.0-514.71.1.el7, python-perf 3.10.0-514.71.1.el7, kernel-tools 3.10.0-514.71.1.el7, kernel-tools-libs 3.10.0-514.71.1.el7, kernel-bootwrapper 3.10.0-514.71.1.el7, +3 morefixed: vendor fix RHSA-2019:4159
-
Red Hat Enterprise Linux Server E4S (v. 7.4) perf 3.10.0-693.61.1.el7, kernel 3.10.0-693.61.1.el7, python-perf 3.10.0-693.61.1.el7, kernel-tools 3.10.0-693.61.1.el7, kernel-tools-libs 3.10.0-693.61.1.el7, kernel-bootwrapper 3.10.0-693.61.1.el7, +3 morefixed: vendor fix RHSA-2019:4058
-
Red Hat Enterprise Linux Server EUS (v. 7.5) perf 3.10.0-862.44.2.el7, kernel 3.10.0-862.44.2.el7, python-perf 3.10.0-862.44.2.el7, kernel-kdump 3.10.0-862.44.2.el7, kernel-tools 3.10.0-862.44.2.el7, kernel-tools-libs 3.10.0-862.44.2.el7, +6 morefixed: vendor fix RHSA-2019:3967
-
Red Hat Enterprise Linux Server EUS (v. 7.6) perf 3.10.0-957.35.1.el7, kernel 3.10.0-957.35.1.el7, bpftool 3.10.0-957.35.1.el7, python-perf 3.10.0-957.35.1.el7, kernel-kdump 3.10.0-957.35.1.el7, kernel-tools 3.10.0-957.35.1.el7, +7 morefixed: vendor fix RHSA-2019:2837
-
Red Hat Enterprise Linux Server Optional (v. 6) python-perf 2.6.32-754.18.2.el6, kernel-debuginfo-common-i686 2.6.32-754.18.2.el6, kernel-debuginfo-common-ppc64 2.6.32-754.18.2.el6, kernel-debuginfo-common-s390x 2.6.32-754.18.2.el6, kernel-debuginfo-common-x86_64 2.6.32-754.18.2.el6fixed: vendor fix RHSA-2019:2473
-
Red Hat Enterprise Linux Server Optional (v. 7) kernel-debuginfo-common-ppc64 3.10.0-1062.el7, kernel-debuginfo-common-x86_64 3.10.0-1062.el7, kernel-debuginfo-common-ppc64le 3.10.0-1062.el7fixed: vendor fix RHSA-2019:2029
-
Red Hat Enterprise Linux Server Optional AUS (v. 6.5) kernel 2.6.32-431.97.1.el6, python-perf 2.6.32-431.97.1.el6, kernel-debuginfo-common-x86_64 2.6.32-431.97.1.el6fixed: vendor fix RHSA-2019:4056
-
Red Hat Enterprise Linux Server Optional AUS (v. 6.6) python-perf 2.6.32-504.82.1.el6, kernel-debuginfo-common-x86_64 2.6.32-504.82.1.el6fixed: vendor fix RHSA-2019:4255
-
Red Hat Enterprise Linux Server Optional AUS (v. 7.2) kernel-debuginfo-common-x86_64 3.10.0-327.83.1.el7fixed: vendor fix RHSA-2019:4164
-
Red Hat Enterprise Linux Server Optional AUS (v. 7.3) kernel-debuginfo-common-x86_64 3.10.0-514.71.1.el7fixed: vendor fix RHSA-2019:4159
18 more fixed in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-319 Cleartext Transmission of Sensitive Information
- Technology feeds
References
-
github.com
/torvalds/linux/commit/574823bfab82d9d8fa47f422778043fbb4b4f50e
patch, third-party-advisory
-
git.kernel.org
/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=574823bfab82d9d8fa47f422778043fbb4b4f50e
patch, vendor-advisory
-
bugzilla.suse.com
/show_bug.cgi?id=1120843
issue-tracking, patch, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-05/msg00071.html
vendor-advisory
-
debian.org
/security/2019/dsa-4465
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-06/msg00039.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-06/msg00048.html
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:2043
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:2029
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:2473
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:2808
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:2837
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:2809
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:3309
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:3517
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:3967
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:4058
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:4057
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:4056
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:4159
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:4164
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:4255
vendor-advisory
-
access.redhat.com
/errata/RHSA-2020:0204
vendor-advisory
-
securityfocus.com
/bid/106478
vdb-entry, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2019/06/msg00010.html
mailing-list
-
lists.debian.org
/debian-lts-announce/2019/06/msg00011.html
mailing-list
-
seclists.org
/bugtraq/2019/Jun/26
mailing-list
- oracle.com /security-alerts/cpujul2020.html
-
theregister.co.uk
/2019/01/05/boffins_beat_page_cache/
technical-description, third-party-advisory
-
arxiv.org
/abs/1901.01161
third-party-advisory
-
security.netapp.com
/advisory/ntap-20190307-0001/
third-party-advisory
- huawei.com /en/psirt/security-advisories/huawei-sa-20200115-01-pagecache-en
Sources
- CVE List CVE-2019-5489
- NVD CVE-2019-5489
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.