Skip to content
OpenAdvisories
Medium · 5.6 Public exploit CVE-2019-1125 EUVD-2019-9702GHSA-r79p-pw9q-gxrc

Windows Kernel Information Disclosure Vulnerability

Published Sep 3, 2019 · Updated Aug 4, 2024 · Assigned by microsoft

Vendor: Microsoft Product: Windows 10 Version 1507 Product: Windows 10 Version 1607 Product: Windows 10 Version 1703 Product: Windows 10 Version 1709 Product: Windows 10 Version 1709 for 32-bit Systems Product: Windows 10 Version 1803 Product: Windows 10 Version 1809 Product: Windows 10 Version 1903 for 32-bit Systems Product: Windows 10 Version 1903 for ARM64-based Systems Product: Windows 10 Version 1903 for x64-based Systems Product: Windows 7 Product: Windows 7 Service Pack 1 Product: Windows 8.1 Product: Windows Server 2008 R2 Service Pack 1 Product: Windows Server 2008 R2 Service Pack 1 (Server Core installation) Product: Windows Server 2008 R2 Systems Service Pack 1 Product: Windows Server 2008 Service Pack 2 Product: Windows Server 2008 Service Pack 2 (Server Core installation) Product: Windows Server 2012 Product: Windows Server 2012 (Server Core installation) Product: Windows Server 2012 R2 Product: Windows Server 2012 R2 (Server Core installation) Product: Windows Server 2016 Product: Windows Server 2016 (Server Core installation) Product: Windows Server 2019 Product: Windows Server 2019 (Server Core installation) Product: Windows Server, version 1803 (Server Core Installation) Product: Windows Server, version 1903 (Server Core installation) Package: linux Package: linux Package: linux-aws Package: linux-aws-fips Package: linux-aws-hwe Package: linux-azure Package: linux-azure-fde Package: linux-azure-fde-5.15 Package: linux-fips Package: linux-gcp Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.0 Package: linux-hwe Package: linux-hwe-edge Package: linux-intel-iot-realtime Package: linux-kvm Package: linux-lts-xenial Package: linux-oem Package: linux-oem-osp1 Package: linux-oracle Package: linux-raspi-realtime Package: linux-realtime Package: linux-riscv Package: linux-vmware Platform: Windows Ecosystem: Debian Ecosystem: Ubuntu

Description

An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory. An attacker who successfully exploited the vulnerability could read privileged data across trust boundaries.
To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to elevate user rights directly, but it could be used to obtain information that could be used to try to compromise the affected system further.
On January 3, 2018, Microsoft released an advisory and security updates related to a newly-discovered class of hardware vulnerabilities (known as Spectre) involving speculative execution side channels that affect AMD, ARM, and Intel CPUs to varying degrees. This vulnerability, released on August 6, 2019, is a variant of the Spectre Variant 1 speculative execution side channel vulnerability and has been assigned CVE-2019-1125.
Microsoft released a security update on July 9, 2019 that addresses the vulnerability through a software change that mitigates how the CPU speculatively accesses memory. Note that this vulnerability does not require a microcode update from your device OEM.

Affected products

VendorProductAffectedFixed
Microsoft Windows 10 Version 1703 10.0.0 – < publication publication
Microsoft Windows 10 Version 1803 10.0.0 – < publication publication
Microsoft Windows Server, version 1803 (Server Core Installation) 10.0.0 – < publication publication
Microsoft Windows 10 Version 1809 10.0.0 – < publication publication
Microsoft Windows Server 2019 10.0.0 – < publication publication
Microsoft Windows Server 2019 (Server Core installation) 10.0.0 – < publication publication
Microsoft Windows 10 Version 1709 for 32-bit Systems 10.0.0 – < publication publication
Microsoft Windows 10 Version 1709 10.0.0 – < publication publication
Microsoft Windows 10 Version 1903 for 32-bit Systems 10.0.0 – < publication publication
Microsoft Windows 10 Version 1903 for x64-based Systems 10.0.0 – < publication publication
Microsoft Windows 10 Version 1903 for ARM64-based Systems 10.0.0 – < publication publication
Microsoft Windows Server, version 1903 (Server Core installation) 10.0.0 – < publication publication
Microsoft Windows 10 Version 1507 10.0.0 – < publication publication
Microsoft Windows 10 Version 1607 10.0.0 – < publication publication
Microsoft Windows Server 2016 10.0.0 – < publication publication
Microsoft Windows Server 2016 (Server Core installation) 10.0.0 – < publication publication
Microsoft Windows 7 6.1.0 – < publication publication
Microsoft Windows 7 Service Pack 1 6.1.0 – < publication publication
Microsoft Windows 8.1 6.3.0 – < publication publication
Microsoft Windows Server 2008 Service Pack 2 6.0.0 – < publication publication
Microsoft Windows Server 2008 Service Pack 2 (Server Core installation) 6.0.0 – < publication publication
Microsoft Windows Server 2008 Service Pack 2 6.0.0 – < publication publication
Microsoft Windows Server 2008 R2 Systems Service Pack 1 6.1.0 – < publication publication
Microsoft Windows Server 2008 R2 Service Pack 1 6.1.0 – < publication publication
Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation) 6.0.0 – < publication publication
Microsoft Windows Server 2012 6.2.0 – < publication publication
Microsoft Windows Server 2012 (Server Core installation) 6.2.0 – < publication publication
Microsoft Windows Server 2012 R2 6.3.0 – < publication publication
Microsoft Windows Server 2012 R2 (Server Core installation) 6.3.0 – < publication publication

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 5.2.7-1 —
Debian 13 linux 5.2.7-1 —
Debian 12 linux 5.2.7-1 —
Debian 10 linux 4.19.37-5+deb10u2 DSA-4495-1
Debian 9 linux 4.9.168-1+deb9u5 DSA-4497-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Debian 8 linux 3.16.72-1 DLA-1884-1
Debian 8 linux-4.9 4.9.168-1+deb9u5~deb8u1 DLA-1885-1
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux-raspi-realtime No fix yet —
Ubuntu 22.04 LTS linux-riscv +2 No fix yet —
Ubuntu 20.04 LTS linux-gke +2 No fix yet —
Ubuntu 18.04 LTS linux 4.15.0-58.64 USN-4094-1
Ubuntu 18.04 LTS linux-aws 4.15.0-1045.47 USN-4096-1
Ubuntu 18.04 LTS linux-azure 5.0.0-1014.14~18.04.1 USN-4093-1
Ubuntu 18.04 LTS linux-gcp +1 4.15.0-1040.42 USN-4094-1
Ubuntu 18.04 LTS linux-gke-5.0 5.0.0-1013.13~18.04.1 —
Ubuntu 18.04 LTS linux-hwe 5.0.0-25.26~18.04.1 USN-4093-1
Ubuntu 18.04 LTS linux-hwe-edge No fix yet —
Ubuntu 18.04 LTS linux-kvm 4.15.0-1042.42 USN-4094-1
Ubuntu 18.04 LTS linux-oem 4.15.0-1050.57 USN-4094-1
Ubuntu 18.04 LTS linux-oem-osp1 5.0.0-1018.20 —
Ubuntu 18.04 LTS linux-oracle 4.15.0-1021.23 USN-4094-1
Ubuntu 18.04 LTS linux-raspi2 4.15.0-1043.46 USN-4094-1
Ubuntu 18.04 LTS linux-snapdragon 4.15.0-1060.66 USN-4094-1
Ubuntu 16.04 LTS linux 4.4.0-159.187 USN-4095-1
Ubuntu 16.04 LTS linux-aws 4.4.0-1090.101 USN-4095-1
Ubuntu 16.04 LTS linux-aws-hwe 4.15.0-1045.47~16.04.1 USN-4096-1
Ubuntu 16.04 LTS linux-azure 4.15.0-1055.60 USN-4094-1
Ubuntu 16.04 LTS linux-gcp 4.15.0-1040.42~16.04.1 USN-4094-1
Ubuntu 16.04 LTS linux-hwe 4.15.0-58.64~16.04.1 USN-4094-1
Ubuntu 16.04 LTS linux-kvm 4.4.0-1054.61 USN-4095-1
Ubuntu 16.04 LTS linux-oracle 4.15.0-1021.23~16.04.1 USN-4094-1
Ubuntu 16.04 LTS linux-raspi2 4.4.0-1118.127 USN-4095-1
Ubuntu 16.04 LTS linux-snapdragon 4.4.0-1122.128 USN-4095-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro FIPS 18.04 LTS linux-aws-fips +1 No fix yet —
Ubuntu Pro FIPS-updates 18.04 LTS linux-aws-fips 4.15.0-2018.18 —
Ubuntu Pro FIPS-updates 16.04 LTS linux-fips 4.4.0-1017.22 —
Ubuntu Pro 20.04 LTS linux-azure-fde-5.15 5.15.0-1114.123~20.04.1 —
Ubuntu Pro 14.04 LTS linux No fix yet —
Ubuntu Pro 14.04 LTS linux-aws 4.4.0-1054.58 USN-4095-2
Ubuntu Pro 14.04 LTS linux-azure 4.15.0-1059.64~14.04.1 —
Ubuntu Pro 14.04 LTS linux-lts-xenial 4.4.0-164.192~14.04.1 USN-4095-2
ReleasePackageFixed inAdvisory
RHEL 8 kernel-rt +12 4.18.0-80.7.2.rt9.154.el8_0 RHSA-2019:2405
RHEL 8 perf +26 4.18.0-80.7.2.el8_0 RHSA-2019:2411
RHEL 7 imgbased +1 1.1.10-0.1.el7ev RHSA-2019:3011
RHEL 7 kernel +15 3.10.0-1062.1.1.el7 RHSA-2019:2600
RHEL 7 kernel-rt +10 3.10.0-1062.1.1.rt56.1024.el7 RHSA-2019:2609
RHEL 7 ovirt-node-ng +2 4.3.6-0.20190820.0.el7ev RHSA-2019:3011
RHEL 7 perf +2 3.10.0-957.38.1.el7 RHSA-2019:3220, RHSA-2019:2600
RHEL 7 redhat-release-virtualization-host +2 4.2-15.1.el7 RHSA-2019:3011, RHBA-2019:3248
RHEL 7 redhat-virtualization-host +1 4.2-20191022.0.el7_6 RHSA-2019:3011, RHBA-2019:3248
RHEL 6 perf +15 2.6.32-754.18.2.el6 RHSA-2019:2473
Show 12 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 7.6 EUS perf +18 3.10.0-957.38.1.el7 RHSA-2019:3220
RHEL 7.5 EUS perf +17 3.10.0-862.43.1.el7 RHSA-2019:2975
RHEL 7.4 EUS perf +17 3.10.0-693.58.1.el7 RHSA-2019:2696
RHEL 7.3 TUS perf +11 3.10.0-514.69.1.el7 RHSA-2019:2900
RHEL 7.3 E4S perf +13 3.10.0-514.69.1.el7 RHSA-2019:2900
RHEL 7.3 AUS perf +11 3.10.0-514.69.1.el7 RHSA-2019:2900
RHEL 7.2 TUS perf +11 3.10.0-327.82.1.el7 RHSA-2019:2899
RHEL 7.2 E4S perf +11 3.10.0-327.82.1.el7 RHSA-2019:2899
RHEL 7.2 AUS perf +11 3.10.0-327.82.1.el7 RHSA-2019:2899
RHEL 6.6 AUS perf +9 2.6.32-504.80.2.el6 RHSA-2019:2476
RHEL 6.5 AUS perf +9 2.6.32-431.96.1.el6 RHSA-2019:2695
Red Hat MRG 2 kernel-rt +10 1:3.10.0-693.58.1.rt56.652.el6rt RHSA-2019:2730
ReleasePackageFixed inAdvisory
SLES 15 SP1 kernel-azure +2 4.12.14-8.13.1 SUSE-SU-2019:2069-1
SLES 15 SP1 kernel-docs +5 4.12.14-197.15.1 SUSE-SU-2019:2073-1
SLES 15 kernel-azure +2 4.12.14-5.38.1 SUSE-SU-2019:2068-1
SLES 15 kernel-docs +6 4.12.14-150.32.1 SUSE-SU-2019:2071-1
SLES 12 SP4 kernel-azure +2 4.12.14-6.23.1 SUSE-SU-2019:2070-1
SLES 12 SP4 kernel-docs +4 4.12.14-95.29.1 SUSE-SU-2019:2072-1
SLES 12 SP3 kernel-syms +2 4.4.180-94.103.1 SUSE-SU-2019:2263-1
SLES 12 SP3 kgraft-patch-SLE12-SP3_Update_28 1-4.3.1 SUSE-SU-2019:2263-1
SLES 12 SP2 kernel-syms +2 4.4.121-92.120.1 SUSE-SU-2019:2299-1
SLES 12 SP2 kgraft-patch-SLE12-SP2_Update_32 1-3.3.1 SUSE-SU-2019:2299-1
Show 18 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP1 kernel-xen +3 3.12.74-60.64.121.1 SUSE-SU-2019:2262-1
SLES 12 SP1 kgraft-patch-SLE12-SP1_Update_36 1-2.3.1 SUSE-SU-2019:2262-1
SLES 12 kernel-ec2 3.12.74-60.64.121.1 SUSE-SU-2019:2262-1
SLES 11 SP4 kernel-ec2 +8 3.0.101-108.101.1 SUSE-SU-2019:14157-1
SLES for SAP 12 SP4 kernel-azure +2 4.12.14-6.23.1 SUSE-SU-2019:2070-1
SLES for SAP 12 SP4 kernel-syms +2 4.12.14-95.29.1 SUSE-SU-2019:2072-1
SLES for SAP 12 SP3 kernel-syms +2 4.4.180-94.103.1 SUSE-SU-2019:2263-1
SLES for SAP 12 SP3 kgraft-patch-SLE12-SP3_Update_28 1-4.3.1 SUSE-SU-2019:2263-1
SLES for SAP 12 SP2 kernel-syms +2 4.4.121-92.120.1 SUSE-SU-2019:2299-1
SLES for SAP 12 SP2 kgraft-patch-SLE12-SP2_Update_32 1-3.3.1 SUSE-SU-2019:2299-1
SLES for SAP 12 SP1 kernel-xen +3 3.12.74-60.64.121.1 SUSE-SU-2019:2262-1
SLES for SAP 12 SP1 kgraft-patch-SLE12-SP1_Update_36 1-2.3.1 SUSE-SU-2019:2262-1
SLE Real Time 12 SP4 kernel-rt +3 4.12.14-8.3.1 SUSE-SU-2019:2450-1
SLE Live Patching 15 SP1 kernel-default 4.12.14-197.15.1 SUSE-SU-2019:2073-1
SLE Live Patching 15 SP1 kernel-livepatch-SLE15-SP1_Update_4 1-3.5.1 SUSE-SU-2019:2073-1
SLE Live Patching 15 kernel-default 4.12.14-150.32.1 SUSE-SU-2019:2071-1
SLE Live Patching 15 kernel-livepatch-SLE15_Update_13 1-1.5.1 SUSE-SU-2019:2071-1
SLE Live Patching 12 SP4 kgraft-patch-SLE12-SP4_Update_7 1-6.5.1 SUSE-SU-2019:2072-1
SUSE Real Time Module 15 SP1 kernel-rt +3 4.12.14-14.8.1 SUSE-SU-2019:2430-1
SUSE OpenStack Cloud Crowbar 8 kernel-syms +2 4.4.180-94.103.1 SUSE-SU-2019:2263-1
SUSE OpenStack Cloud Crowbar 8 kgraft-patch-SLE12-SP3_Update_28 1-4.3.1 SUSE-SU-2019:2263-1
SUSE OpenStack Cloud 8 kernel-syms +2 4.4.180-94.103.1 SUSE-SU-2019:2263-1
SUSE OpenStack Cloud 8 kgraft-patch-SLE12-SP3_Update_28 1-4.3.1 SUSE-SU-2019:2263-1
SUSE OpenStack Cloud 7 kernel-syms +2 4.4.121-92.120.1 SUSE-SU-2019:2299-1
SUSE OpenStack Cloud 7 kgraft-patch-SLE12-SP2_Update_32 1-3.3.1 SUSE-SU-2019:2299-1
SUSE HPE Helion OpenStack 8 kernel-syms +2 4.4.180-94.103.1 SUSE-SU-2019:2263-1
SUSE HPE Helion OpenStack 8 kgraft-patch-SLE12-SP3_Update_28 1-4.3.1 SUSE-SU-2019:2263-1
SUSE Enterprise Storage 5 kernel-syms +2 4.4.180-94.103.1 SUSE-SU-2019:2263-1
SUSE Enterprise Storage 5 kgraft-patch-SLE12-SP3_Update_28 1-4.3.1 SUSE-SU-2019:2263-1
SUSE Enterprise Storage 4 kernel-syms +2 4.4.121-92.120.1 SUSE-SU-2019:2299-1
SUSE Enterprise Storage 4 kgraft-patch-SLE12-SP2_Update_32 1-3.3.1 SUSE-SU-2019:2299-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.1 kernel-docs +8 4.12.14-lp151.28.13.1 openSUSE-SU-2019:1923-1
openSUSE Leap 15.0 kernel-docs +8 4.12.14-lp150.12.70.1 openSUSE-SU-2019:1924-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 perf +8 4.14.133-113.112.amzn2 ALAS2-2019-1253

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 perf +19 4.18.0-80.7.2.el8_0 ELSA-2019-2411
Oracle Linux 7 dtrace-modules-3.8.13-118.38.1.el6uek 0.4.5-3.el6 ELSA-2019-4775
Oracle Linux 7 dtrace-modules-3.8.13-118.38.1.el7uek 0.4.5-3.el7 ELSA-2019-4775
Oracle Linux 7 kernel-uek +5 3.8.13-118.38.1.el7uek ELSA-2019-4775, ELSA-2019-4746, ELSA-2019-4735
Oracle Linux 7 kernel-uek-tools +3 4.14.35-1902.3.2.el7uek ELSA-2019-4746, ELSA-2019-4733
Oracle Linux 7 perf +12 3.10.0-1062.1.1.el7 ELSA-2019-4746, ELSA-2019-4733, ELSA-2019-2600

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 1 repository

  • bitdefender/swapgs-attack-poc ★ 41 · Jan 27, 2020

    This repository contains the sources and documentation for the SWAPGS attack PoC (CVE-2019-1125)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 47

References