CVE-2024-35871 (GCVE-0-2024-35871)

Vulnerability from cvelistv5 – Published: 2024-05-19 08:34 – Updated: 2025-05-04 09:07
VLAI?
Title
riscv: process: Fix kernel gp leakage
Summary
In the Linux kernel, the following vulnerability has been resolved: riscv: process: Fix kernel gp leakage childregs represents the registers which are active for the new thread in user context. For a kernel thread, childregs->gp is never used since the kernel gp is not touched by switch_to. For a user mode helper, the gp value can be observed in user space after execve or possibly by other means. [From the email thread] The /* Kernel thread */ comment is somewhat inaccurate in that it is also used for user_mode_helper threads, which exec a user process, e.g. /sbin/init or when /proc/sys/kernel/core_pattern is a pipe. Such threads do not have PF_KTHREAD set and are valid targets for ptrace etc. even before they exec. childregs is the *user* context during syscall execution and it is observable from userspace in at least five ways: 1. kernel_execve does not currently clear integer registers, so the starting register state for PID 1 and other user processes started by the kernel has sp = user stack, gp = kernel __global_pointer$, all other integer registers zeroed by the memset in the patch comment. This is a bug in its own right, but I'm unwilling to bet that it is the only way to exploit the issue addressed by this patch. 2. ptrace(PTRACE_GETREGSET): you can PTRACE_ATTACH to a user_mode_helper thread before it execs, but ptrace requires SIGSTOP to be delivered which can only happen at user/kernel boundaries. 3. /proc/*/task/*/syscall: this is perfectly happy to read pt_regs for user_mode_helpers before the exec completes, but gp is not one of the registers it returns. 4. PERF_SAMPLE_REGS_USER: LOCKDOWN_PERF normally prevents access to kernel addresses via PERF_SAMPLE_REGS_INTR, but due to this bug kernel addresses are also exposed via PERF_SAMPLE_REGS_USER which is permitted under LOCKDOWN_PERF. I have not attempted to write exploit code. 5. Much of the tracing infrastructure allows access to user registers. I have not attempted to determine which forms of tracing allow access to user registers without already allowing access to kernel registers.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7db91e57a0acde126a162ababfb1e0ab190130cb , < 9abc3e6f1116adb7a2d4fbb8ce20c37916976bf5 (git)
Affected: 7db91e57a0acde126a162ababfb1e0ab190130cb , < dff6072124f6df77bfd36951fbd88565746980ef (git)
Affected: 7db91e57a0acde126a162ababfb1e0ab190130cb , < f6583444d7e78dae750798552b65a2519ff3ca84 (git)
Affected: 7db91e57a0acde126a162ababfb1e0ab190130cb , < 00effef72c98294edb1efa87ffa0f6cfb61b36a4 (git)
Affected: 7db91e57a0acde126a162ababfb1e0ab190130cb , < d8dcba0691b8e42bddb61aab201e4d918a08e5d9 (git)
Affected: 7db91e57a0acde126a162ababfb1e0ab190130cb , < d14fa1fcf69db9d070e75f1c4425211fa619dfc8 (git)
Create a notification for this product.
    Linux Linux Affected: 4.15
Unaffected: 0 , < 4.15 (semver)
Unaffected: 5.10.216 , ≤ 5.10.* (semver)
Unaffected: 5.15.154 , ≤ 5.15.* (semver)
Unaffected: 6.1.85 , ≤ 6.1.* (semver)
Unaffected: 6.6.26 , ≤ 6.6.* (semver)
Unaffected: 6.8.5 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35871",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:38:51.778237Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:41:55.174Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:49.064Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9abc3e6f1116adb7a2d4fbb8ce20c37916976bf5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dff6072124f6df77bfd36951fbd88565746980ef"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f6583444d7e78dae750798552b65a2519ff3ca84"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/00effef72c98294edb1efa87ffa0f6cfb61b36a4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d8dcba0691b8e42bddb61aab201e4d918a08e5d9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d14fa1fcf69db9d070e75f1c4425211fa619dfc8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/riscv/kernel/process.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9abc3e6f1116adb7a2d4fbb8ce20c37916976bf5",
              "status": "affected",
              "version": "7db91e57a0acde126a162ababfb1e0ab190130cb",
              "versionType": "git"
            },
            {
              "lessThan": "dff6072124f6df77bfd36951fbd88565746980ef",
              "status": "affected",
              "version": "7db91e57a0acde126a162ababfb1e0ab190130cb",
              "versionType": "git"
            },
            {
              "lessThan": "f6583444d7e78dae750798552b65a2519ff3ca84",
              "status": "affected",
              "version": "7db91e57a0acde126a162ababfb1e0ab190130cb",
              "versionType": "git"
            },
            {
              "lessThan": "00effef72c98294edb1efa87ffa0f6cfb61b36a4",
              "status": "affected",
              "version": "7db91e57a0acde126a162ababfb1e0ab190130cb",
              "versionType": "git"
            },
            {
              "lessThan": "d8dcba0691b8e42bddb61aab201e4d918a08e5d9",
              "status": "affected",
              "version": "7db91e57a0acde126a162ababfb1e0ab190130cb",
              "versionType": "git"
            },
            {
              "lessThan": "d14fa1fcf69db9d070e75f1c4425211fa619dfc8",
              "status": "affected",
              "version": "7db91e57a0acde126a162ababfb1e0ab190130cb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/riscv/kernel/process.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.216",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.154",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.85",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.26",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: process: Fix kernel gp leakage\n\nchildregs represents the registers which are active for the new thread\nin user context. For a kernel thread, childregs-\u003egp is never used since\nthe kernel gp is not touched by switch_to. For a user mode helper, the\ngp value can be observed in user space after execve or possibly by other\nmeans.\n\n[From the email thread]\n\nThe /* Kernel thread */ comment is somewhat inaccurate in that it is also used\nfor user_mode_helper threads, which exec a user process, e.g. /sbin/init or\nwhen /proc/sys/kernel/core_pattern is a pipe. Such threads do not have\nPF_KTHREAD set and are valid targets for ptrace etc. even before they exec.\n\nchildregs is the *user* context during syscall execution and it is observable\nfrom userspace in at least five ways:\n\n1. kernel_execve does not currently clear integer registers, so the starting\n   register state for PID 1 and other user processes started by the kernel has\n   sp = user stack, gp = kernel __global_pointer$, all other integer registers\n   zeroed by the memset in the patch comment.\n\n   This is a bug in its own right, but I\u0027m unwilling to bet that it is the only\n   way to exploit the issue addressed by this patch.\n\n2. ptrace(PTRACE_GETREGSET): you can PTRACE_ATTACH to a user_mode_helper thread\n   before it execs, but ptrace requires SIGSTOP to be delivered which can only\n   happen at user/kernel boundaries.\n\n3. /proc/*/task/*/syscall: this is perfectly happy to read pt_regs for\n   user_mode_helpers before the exec completes, but gp is not one of the\n   registers it returns.\n\n4. PERF_SAMPLE_REGS_USER: LOCKDOWN_PERF normally prevents access to kernel\n   addresses via PERF_SAMPLE_REGS_INTR, but due to this bug kernel addresses\n   are also exposed via PERF_SAMPLE_REGS_USER which is permitted under\n   LOCKDOWN_PERF. I have not attempted to write exploit code.\n\n5. Much of the tracing infrastructure allows access to user registers. I have\n   not attempted to determine which forms of tracing allow access to user\n   registers without already allowing access to kernel registers."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T09:07:18.449Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9abc3e6f1116adb7a2d4fbb8ce20c37916976bf5"
        },
        {
          "url": "https://git.kernel.org/stable/c/dff6072124f6df77bfd36951fbd88565746980ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6583444d7e78dae750798552b65a2519ff3ca84"
        },
        {
          "url": "https://git.kernel.org/stable/c/00effef72c98294edb1efa87ffa0f6cfb61b36a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8dcba0691b8e42bddb61aab201e4d918a08e5d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/d14fa1fcf69db9d070e75f1c4425211fa619dfc8"
        }
      ],
      "title": "riscv: process: Fix kernel gp leakage",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35871",
    "datePublished": "2024-05-19T08:34:29.292Z",
    "dateReserved": "2024-05-17T13:50:33.108Z",
    "dateUpdated": "2025-05-04T09:07:18.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35871\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-17T17:38:51.778237Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-17T17:38:52.800Z\"}}], \"cna\": {\"title\": \"riscv: process: Fix kernel gp leakage\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7db91e57a0ac\", \"lessThan\": \"9abc3e6f1116\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7db91e57a0ac\", \"lessThan\": \"dff6072124f6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7db91e57a0ac\", \"lessThan\": \"f6583444d7e7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7db91e57a0ac\", \"lessThan\": \"00effef72c98\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7db91e57a0ac\", \"lessThan\": \"d8dcba0691b8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7db91e57a0ac\", \"lessThan\": \"d14fa1fcf69d\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/riscv/kernel/process.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.15\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"5.10.216\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.154\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.85\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.26\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.5\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/riscv/kernel/process.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9abc3e6f1116adb7a2d4fbb8ce20c37916976bf5\"}, {\"url\": \"https://git.kernel.org/stable/c/dff6072124f6df77bfd36951fbd88565746980ef\"}, {\"url\": \"https://git.kernel.org/stable/c/f6583444d7e78dae750798552b65a2519ff3ca84\"}, {\"url\": \"https://git.kernel.org/stable/c/00effef72c98294edb1efa87ffa0f6cfb61b36a4\"}, {\"url\": \"https://git.kernel.org/stable/c/d8dcba0691b8e42bddb61aab201e4d918a08e5d9\"}, {\"url\": \"https://git.kernel.org/stable/c/d14fa1fcf69db9d070e75f1c4425211fa619dfc8\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\"}], \"x_generator\": {\"engine\": \"bippy-a5840b7849dd\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nriscv: process: Fix kernel gp leakage\\n\\nchildregs represents the registers which are active for the new thread\\nin user context. For a kernel thread, childregs-\u003egp is never used since\\nthe kernel gp is not touched by switch_to. For a user mode helper, the\\ngp value can be observed in user space after execve or possibly by other\\nmeans.\\n\\n[From the email thread]\\n\\nThe /* Kernel thread */ comment is somewhat inaccurate in that it is also used\\nfor user_mode_helper threads, which exec a user process, e.g. /sbin/init or\\nwhen /proc/sys/kernel/core_pattern is a pipe. Such threads do not have\\nPF_KTHREAD set and are valid targets for ptrace etc. even before they exec.\\n\\nchildregs is the *user* context during syscall execution and it is observable\\nfrom userspace in at least five ways:\\n\\n1. kernel_execve does not currently clear integer registers, so the starting\\n   register state for PID 1 and other user processes started by the kernel has\\n   sp = user stack, gp = kernel __global_pointer$, all other integer registers\\n   zeroed by the memset in the patch comment.\\n\\n   This is a bug in its own right, but I\u0027m unwilling to bet that it is the only\\n   way to exploit the issue addressed by this patch.\\n\\n2. ptrace(PTRACE_GETREGSET): you can PTRACE_ATTACH to a user_mode_helper thread\\n   before it execs, but ptrace requires SIGSTOP to be delivered which can only\\n   happen at user/kernel boundaries.\\n\\n3. /proc/*/task/*/syscall: this is perfectly happy to read pt_regs for\\n   user_mode_helpers before the exec completes, but gp is not one of the\\n   registers it returns.\\n\\n4. PERF_SAMPLE_REGS_USER: LOCKDOWN_PERF normally prevents access to kernel\\n   addresses via PERF_SAMPLE_REGS_INTR, but due to this bug kernel addresses\\n   are also exposed via PERF_SAMPLE_REGS_USER which is permitted under\\n   LOCKDOWN_PERF. I have not attempted to write exploit code.\\n\\n5. Much of the tracing infrastructure allows access to user registers. I have\\n   not attempted to determine which forms of tracing allow access to user\\n   registers without already allowing access to kernel registers.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-05-29T05:30:27.722Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35871\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-05-29T05:30:27.722Z\", \"dateReserved\": \"2024-05-17T13:50:33.108Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-19T08:34:29.292Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.