CVE-2024-35871

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

riscv: process: Fix kernel gp leakage

childregs represents the registers which are active for the new thread

in user context. For a kernel thread, childregs->gp is never used since

the kernel gp is not touched by switch_to. For a user mode helper, the

gp value can be observed in user space after execve or possibly by other

means.

[From the email thread]

The /* Kernel thread */ comment is somewhat inaccurate in that it is also used

for user_mode_helper threads, which exec a user process, e.g. /sbin/init or

when /proc/sys/kernel/core_pattern is a pipe. Such threads do not have

PF_KTHREAD set and are valid targets for ptrace etc. even before they exec.

childregs is the *user* context during syscall execution and it is observable

from userspace in at least five ways:

1. kernel_execve does not currently clear integer registers, so the starting

register state for PID 1 and other user processes started by the kernel

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References