CVE-2019-19339

It was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207. A flaw was found in the way Intel CPUs handle inconsistency between, virtual to physical memory address translations in CPU's local cache and system software's Paging structure entries. A privileged guest user may use this flaw to induce a hardware Machine Check Error on the host processor, resulting in a severe DoS scenario by halting the processor. System software like OS OR Virtual Machine Monitor (VMM) use virtual memory system for storing program instructions and data in memory. Virtual Memory system uses Paging structures like Page Tables and Page Directories to manage system memory. The processor's Memory Management Unit (MMU) uses Paging structure entries to translate program's virtual memory addresses to physical memory addresses. The processor stores these address translations into its local cache buffer called - Translation Lookaside Buffer (TLB). TLB has two parts, one for instructions and other for data addresses. System software can modify its Paging structure entries to change address mappings OR certain attributes like page size etc. Upon such Paging structure alterations in memory, system software must invalidate the corresponding address translations in the processor's TLB cache. But before this TLB invalidation takes place, a privileged guest user may trigger an instruction fetch operation, which could use an already cached, but now invalid, virtual to physical address translation from Instruction TLB (ITLB). Thus accessing an invalid physical memory address and resulting in halting the processor due to the Machine Check Error (MCE) on Page Size Change.

• CWE-805

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19339Issue Tracking, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19339Issue Tracking, Vendor Advisory

Published

Jan 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19333In all versions of libyang before 1.0-r5, a stack-based buff…9.8
• CVE-2019-19334In all versions of libyang before 1.0-r5, a stack-based buff…9.8
• CVE-2019-19335During installation of an OpenShift 4 cluster, the `openshif…4.4
• CVE-2019-19336A cross-site scripting vulnerability was reported in the oVi…6.1
• CVE-2019-19337A flaw was found in Red Hat Ceph Storage version 3 in the wa…6.5
• CVE-2019-19338A flaw was found in the fix for CVE-2019-11135, in the Linux…5.5
• CVE-2019-1934A vulnerability in the web-based management interface of Cis…8.8
• CVE-2019-19340A flaw was found in Ansible Tower, versions 3.6.x before 3.6…8.2
• CVE-2019-19341A flaw was found in Ansible Tower, versions 3.6.x before 3.6…5.5
• CVE-2019-19342A flaw was found in Ansible Tower, versions 3.6.x before 3.6…5.3
• CVE-2019-19343A flaw was found in Undertow when using Remoting as shipped …7.5
• CVE-2019-19344There is a use-after-free issue in all samba 4.9.x versions …6.5