diff mbox series

[v2,02/10] cve-exclusion: set status for CVE-2021-3714

Message ID 20260803084827.1348810-3-junjie.cao@linux.dev
State New
Headers show
Series cve-exclusion: triage ten kernel CVEs lacking upstream fix data | expand

Commit Message

Junjie Cao Aug. 3, 2026, 8:48 a.m. UTC 
KSM merges identical anonymous pages across processes. An attacker who
can place chosen page-sized content in a victim's memory can detect the
merge through the timing of the resulting copy-on-write fault, and so
leak memory contents remotely.

This cannot be fixed without removing deduplication, and the affected
projects have said so explicitly. Red Hat closed the issue WONTFIX:

  https://bugzilla.redhat.com/show_bug.cgi?id=1931327

Debian marks src:linux unfixed with the note "Inherent design
limitation, can be avoided by not using KSM":

  https://security-tracker.debian.org/tracker/CVE-2021-3714

Ubuntu records "there is no upstream fix available as of 2024-06-17" and
lists disabling KSM as the only mitigation:

  https://ubuntu.com/security/CVE-2021-3714

CONFIG_KSM=y is set in yocto-kernel-cache (bsp/intel-x86 and the
paravirt_kvm fragments), so this is not a configuration exclusion.
It does however require two runtime opt-ins: ksm_run defaults to
KSM_RUN_STOP in mm/ksm.c, so ksmd must be started by the administrator,
and memory is only eligible if the process asks for it with
madvise(MADV_MERGEABLE) or prctl(PR_SET_MEMORY_MERGE).

CC: Paul Barker <paul@pbarker.dev>
AI-Generated: Uses Claude (claude-opus-5)
Signed-off-by: Junjie Cao <junjie.cao@linux.dev>
---
changes in v2:
- split out of the single combined patch, one CVE per patch as requested
- added primary source links (disclosures, distribution trackers, mailing
  list threads, upstream commits) to every commit message
- added the three CVEs with no upstream fix as "unpatched" entries instead
  of leaving them undocumented
- disclosed AI assistance per the contributor guide

v1: https://lore.kernel.org/openembedded-core/20260802143444.1178575-1-junjie.cao@linux.dev/

 meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++
 1 file changed, 7 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc
index aaba26fe..9012d328 100644
--- a/meta/recipes-kernel/linux/cve-exclusion.inc
+++ b/meta/recipes-kernel/linux/cve-exclusion.inc
@@ -199,3 +199,10 @@  CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed from v6.18.3"
 # https://www.openwall.com/lists/oss-security/2019/12/05/1
 CVE_STATUS[CVE-2019-14899] = "upstream-wontfix: consequence of the default weak \
 host model, no kernel fix exists or is planned, mitigated by firewall configuration"
+
+# Inherent to KSM deduplication, closed WONTFIX by Red Hat. Exposure needs
+# ksmd started at runtime (/sys/kernel/mm/ksm/run defaults to 0) and the
+# workload to opt in via MADV_MERGEABLE or prctl(PR_SET_MEMORY_MERGE).
+# https://bugzilla.redhat.com/show_bug.cgi?id=1931327
+CVE_STATUS[CVE-2021-3714] = "upstream-wontfix: inherent design limitation of \
+KSM page deduplication, closed WONTFIX by Red Hat, no upstream fix planned"