CVE-2023-0597: Infoleak
A flaw possibility of memory leak in the Linux kernel cpuentryarea mapping of X86 CPU data to memory was found in the way user can guess location of exception stack(s) or other important data. A local user could use this flaw to get access to some important data with expected location in memory.
Other sources
A flaw possibility of memory leak in the Linux Kernel found. There is no randomization of the exception stacks happening at all including boot-time randomization. These exception stacks are mapped into the kernel at the same virtual address every time. The exception stack(s) is a particularly easy target because its location can be computed based solely on CPU index and kernel version. For the CPU-entry-area, the piece of per-cpu data that is mapped into the userspace page-tables for KPTI is not subject to any randomization (irrespective of KASLR settings). The KASLR-style randomization isn't enough, because attacker probably could discover even the task stacks at least on X86 systems without KPTI with something like the prefetch timing side channel that can test for PTE existence (see reference to the prefetch.pdf). Sure, the system call stack is randomized, but that randomization happens after kernel entry and after ptregs have been saved. It would be good if at least in the worst-case scenario of an attack against the kernel, an attacker wouldn't know fixed addresses where zeroes / kernel text pointers / other known values are stored. As result, straight forward randomization scheme that avoids duplicates to spread the existing CPUs over the available space suggested (see reference to the patch).
References: https://gruss.cc/files/prefetch.pdf https://lore.kernel.org/lkml/Yz%2FmfJ1gjgshF19t@hirez.programming.kicks-ass.net/ https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/arch/x86/mm/cpuentryarea.c?h=v6.2-rc6&id=97e3d26b5e5f371b3ee223d94dd123e6c442ba80
— Red Hat
A possible unauthorized memory access flaw was found in the Linux kernel cpuentryarea mapping of X86 CPU data to memory, where a user may guess the location of exception stack(s) or other important data. This issue could allow a local user to gain access to some important data with expected location in memory.
Linux Kernel could allow a local attacker to obtain sensitive information, caused by a memory leak in the cpuentryarea mapping of X86 CPU data to memory. An attacker could exploit this vulnerability to gain access to some important data with expected location in memory.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0597?
CVE-2023-0597 has been categorized with medium severity due to the potential for local users to exploit a memory leak.
How do I fix CVE-2023-0597?
To resolve CVE-2023-0597, update your Linux kernel to versions 6.2 or later, or apply the recommended patches for affected distributions.
Who is affected by CVE-2023-0597?
CVE-2023-0597 affects local users of specific versions of the Linux kernel, as well as products from IBM Security Verify Governance and Identity Manager.
What kind of data is at risk with CVE-2023-0597?
CVE-2023-0597 may allow unauthorized access to sensitive data mapped in memory, including exception stacks.
Is CVE-2023-0597 a remote exploitation vulnerability?
No, CVE-2023-0597 requires local access to exploit the memory leak vulnerability.