Bug 2217523 (CVE-2023-3640) - CVE-2023-3640 Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and prefetcht2 instructions being used for the per-cpu entry area mapping to the user space
Summary: CVE-2023-3640 Kernel: x86/mm: a per-cpu entry area leak was identified throug...
Keywords:
Status: NEW
Alias: CVE-2023-3640
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2217524 2221483 2221484 2221485 2221486
Blocks: 2217461
TreeView+ depends on / blocked
 
Reported: 2023-06-26 14:21 UTC by Alex
Modified: 2024-09-11 13:36 UTC (History)
48 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A possible unauthorized memory access flaw was found in the Linux kernel's cpu_entry_area mapping of X86 CPU data to memory, where a user may guess the location of exception stacks or other important data. Based on the previous CVE-2023-0597, the 'Randomize per-cpu entry area' feature was implemented in /arch/x86/mm/cpu_entry_area.c, which works through the init_cea_offsets() function when KASLR is enabled. However, despite this feature, there is still a risk of per-cpu entry area leaks. This issue could allow a local user to gain access to some important data with memory in an expected location and potentially escalate their privileges on the system.
Clone Of:
Environment:
Last Closed: 2023-06-26 18:04:36 UTC
Embargoed:


Attachments (Terms of Use)

Description Alex 2023-06-26 14:21:15 UTC
A flaw in the Linux Kernel found. First, based on the previous similar CVE-2023-0597, the 'Randomize per-cpu entry area' feature was implemented in /arch/x86/mm/cpu_entry_area.c, which works through the init_cea_offsets() function when KASLR is enabled.
However, despite this feature, there is still a risk of per-cpu entry area leaks.
In systems with KPTI enabled, only a minimal amount of kernel virtual memory is mapped for users, such as exception/system call entry handlers and any other necessary content for user-to-kernel transitions. However, discovered that the per-cpu entry area was also mapped to user space. As a result, the prefetchnta and prefetcht2 instructions are still effective, allowing us to leak the per-cpu entry area by conducting time-based attacks using prefetch instructions in the address range of 0xfffffe0000000000-0xfffffefffffff000. In fact, due to the insufficiently large address offset range and the step size of 0x3b000, the cpu entry area can be obtained within one or two minutes.

Essentially, this is a CPU-level address leak vulnerability
that affects the vast majority of Intel CPUs (possibly AMD CPUs as well),
due to the inability to resolve the issues introduced by KPTI (Kernel Page
Table Isolation).

Reference:
https://dl.acm.org/doi/fullHtml/10.1145/3623652.3623669

Comment 2 Alex 2023-06-26 14:27:44 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2217524]


Note You need to log in before you can comment on or make changes to this bug.