Vulnerability in Kernel: x86/entry: Clear X86_FEATURE_SMAP when CONFIG_X86_SMAP=n
Summary
GSD-2021-1001680: x86/entry: Clear X86_FEATURE_SMAP when CONFIG_X86_SMAP=n. Affects Kernel versions >= 3c73b81a9164d0c1b6379d6672d2772a9e95168e, < 4e9ec1c65da98c293f75d83755dfa5e03075a6d0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities, such as managing system resources, handling device drivers, and facilitating communication between different software components. This vulnerability specifically affects the x86/entry module of the Kernel. The x86/entry module is responsible for handling system calls and interrupts on x86-based systems. The vulnerability arises when the CONFIG_X86_SMAP configuration option is disabled, but the X86_FEATURE_SMAP flag is not cleared properly. This misconfiguration can potentially lead to security issues.
Vulnerability Detail
The vulnerability occurs due to a misconfiguration in the x86/entry module of the Kernel. When the CONFIG_X86_SMAP configuration option is disabled, the X86_FEATURE_SMAP flag should also be cleared to ensure proper security. However, this clearing process is not implemented correctly, leaving the flag enabled even when it should be disabled. This vulnerability can be exploited by attackers to bypass the SMAP (Supervisor Mode Access Prevention) protection mechanism, which is designed to prevent unauthorized access to user-space memory from kernel mode. By exploiting this vulnerability, an attacker may gain unauthorized access to sensitive information or execute arbitrary code with elevated privileges.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel is not immediately feasible, a temporary workaround can be applied. The workaround involves manually clearing the X86_FEATURE_SMAP flag when the CONFIG_X86_SMAP configuration option is disabled. This can be achieved by modifying the relevant code in the x86/entry module. Below is an example of the code modification:
// Before
if (IS_ENABLED(CONFIG_X86_SMAP))
x86_capability[0] |= X86_FEATURE_SMAP;
// After
if (!IS_ENABLED(CONFIG_X86_SMAP))
x86_capability[0] &= ~X86_FEATURE_SMAP;
Conclusion
The vulnerability in the Kernel's x86/entry module, which fails to clear the X86_FEATURE_SMAP flag when the CONFIG_X86_SMAP configuration option is disabled, can lead to security breaches. It is crucial to update the Linux Kernel to version v5.14.12 or later to fix this vulnerability. If immediate updating is not possible, applying the provided workaround can help mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can allow attackers to bypass the SMAP protection mechanism and gain unauthorized access to sensitive information or execute arbitrary code with elevated privileges.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert analyzes the package-lock.json file to identify and alert for open-source vulnerabilities in real-time.
Yes, a fix is available in the Linux Kernel version v5.14.12 or later. Updating the Kernel to this version will mitigate the vulnerability.
If updating the Kernel is not immediately feasible, a temporary workaround can be applied by manually clearing the X86_FEATURE_SMAP flag when the CONFIG_X86_SMAP configuration option is disabled. Please refer to the 'workaround' section for more details.
This vulnerability was discovered by the security research team and reported to the Linux Kernel developers.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
