Junglewise Threat Intelligence

CVE-2024-26816: Linux Kernel KASLR bypass via x86 .notes section relocations

CVE-2024-26816 · Severity: medium · CVSS 5.5 · Published 2024-04-10

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's x86 architecture handling could allow a local user to discover sensitive memory layout information. Specifically, when the kernel is configured with certain virtualization features, it inadvertently leaks the base address of Kernel Address Space Layout Randomization (KASLR) through a publicly readable system file. This information leak makes it significantly easier for an attacker to bypass security protections and develop more effective exploits against the operating system.

Technical details

In the Linux kernel on x86 platforms, when building with CONFIG_XEN_PV=y, .text symbols are emitted into the .notes section to facilitate Xen's 'startup_xen' entry point. Because /sys/kernel/notes is world-readable, performing relocations against this section exposes the KASLR base address to unprivileged local users. An attacker can read /sys/kernel/notes to determine the kernel's memory layout, effectively neutralizing KASLR as a security defense. The fix involves modifying arch/x86/tools/relocs.c to skip performing relocations in the .notes section (SHT_NOTE), ensuring the values remain identical to those in the System.map.

Affected products

  • Linux Linux Kernel 2.6.23 to 4.19.311, 4.20 to 5.4.273, 5.5 to 5.10.214, 5.11 to 5.15.153, 5.16 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2

Timeline

  • 2024-02-27: patched: Initial patch authored by Kees Cook
  • 2024-04-10: advisory: CVE-2024-26816 published

References

Related threats