KSM merges identical anonymous pages across processes. An attacker who can place chosen page-sized content in a victim's memory can detect the merge through the timing of the resulting copy-on-write fault, and so leak memory contents remotely.
This cannot be fixed without removing deduplication, and the affected projects have said so explicitly. Red Hat closed the issue WONTFIX: https://bugzilla.redhat.com/show_bug.cgi?id=1931327 Debian marks src:linux unfixed with the note "Inherent design limitation, can be avoided by not using KSM": https://security-tracker.debian.org/tracker/CVE-2021-3714 Ubuntu records "there is no upstream fix available as of 2024-06-17" and lists disabling KSM as the only mitigation: https://ubuntu.com/security/CVE-2021-3714 CONFIG_KSM=y is set in yocto-kernel-cache (bsp/intel-x86 and the paravirt_kvm fragments), so this is not a configuration exclusion. It does however require two runtime opt-ins: ksm_run defaults to KSM_RUN_STOP in mm/ksm.c, so ksmd must be started by the administrator, and memory is only eligible if the process asks for it with madvise(MADV_MERGEABLE) or prctl(PR_SET_MEMORY_MERGE). CC: Paul Barker <[email protected]> AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao <[email protected]> --- changes in v2: - split out of the single combined patch, one CVE per patch as requested - added primary source links (disclosures, distribution trackers, mailing list threads, upstream commits) to every commit message - added the three CVEs with no upstream fix as "unpatched" entries instead of leaving them undocumented - disclosed AI assistance per the contributor guide v1: https://lore.kernel.org/openembedded-core/[email protected]/ meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index aaba26fe..9012d328 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -199,3 +199,10 @@ CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed from v6.18.3" # https://www.openwall.com/lists/oss-security/2019/12/05/1 CVE_STATUS[CVE-2019-14899] = "upstream-wontfix: consequence of the default weak \ host model, no kernel fix exists or is planned, mitigated by firewall configuration" + +# Inherent to KSM deduplication, closed WONTFIX by Red Hat. Exposure needs +# ksmd started at runtime (/sys/kernel/mm/ksm/run defaults to 0) and the +# workload to opt in via MADV_MERGEABLE or prctl(PR_SET_MEMORY_MERGE). +# https://bugzilla.redhat.com/show_bug.cgi?id=1931327 +CVE_STATUS[CVE-2021-3714] = "upstream-wontfix: inherent design limitation of \ +KSM page deduplication, closed WONTFIX by Red Hat, no upstream fix planned" -- 2.43.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242628): https://lists.openembedded.org/g/openembedded-core/message/242628 Mute This Topic: https://lists.openembedded.org/mt/120574080/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
