Executive brief
The Linux kernel's performance monitoring subsystem (perf) on AMD processors can inadvertently expose kernel memory addresses to user-space applications even when instructed to restrict branch sampling to user-space only. An attacker or malicious application could read these kernel addresses to bypass address space layout randomization (ASLR) and facilitate further kernel exploitation.
Technical details
This vulnerability exists in the perf/x86/amd/lbr (Last Branch Record) monitoring component. When a user requests user-only branch sampling via PERF_SAMPLE_BRANCH_USER, the hardware filter only validates the privilege level of the branch target address, allowing branch records originating from kernel code to pass through to user space. The fix implements additional software-level filtering to validate branch-from addresses against the branch selection criteria and drop any records where the source is kernel code. This is an information disclosure vulnerability affecting AMD processors with X86_FEATURE_AMD_LBR_V2 support. No patch details or timeline is currently available.
Affected products
- Linux Linux kernel <UNKNOWN>