On Wed, 2026-08-12 at 02:28 -0500, Junjie Cao wrote: > KSM merges identical anonymous pages across processes. An attacker who > can place chosen page-sized content in a victim's memory can detect the > merge through the timing of the resulting copy-on-write fault, and so > leak memory contents. > > There is no upstream fix; removing the side channel means removing > deduplication. Distribution trackers describe it the same way - Debian > marks src:linux unfixed with "Inherent design limitation, can be avoided > by not using KSM", Red Hat closed its bug WONTFIX, and Ubuntu records no > upstream fix as of 2024-06-17: > > https://security-tracker.debian.org/tracker/CVE-2021-3714 > https://bugzilla.redhat.com/show_bug.cgi?id=1931327 > https://ubuntu.com/security/CVE-2021-3714 > > Exposure requires two runtime opt-ins: ksmd must be started by the > administrator (ksm_run defaults to KSM_RUN_STOP in mm/ksm.c) and memory > is only eligible when a process asks with madvise(MADV_MERGEABLE) or > prctl(PR_SET_MEMORY_MERGE). CONFIG_KSM=y is set in yocto-kernel-cache > (bsp/intel-x86 and the paravirt_kvm fragments), so this is not a > configuration exclusion.
We should drop this third paragraph - it's time consuming to validate. > > CC: Paul Barker <[email protected]> > AI-Generated: Uses Claude (claude-opus-5) > Signed-off-by: Junjie Cao <[email protected]> > --- > v3: > - use "unpatched" instead of "upstream-wontfix": the WONTFIX is a > distribution position, not an upstream one > > v2: > https://lore.kernel.org/openembedded-core/[email protected]/ > > meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc > b/meta/recipes-kernel/linux/cve-exclusion.inc > index 5ed4a00..af3576d 100644 > --- a/meta/recipes-kernel/linux/cve-exclusion.inc > +++ b/meta/recipes-kernel/linux/cve-exclusion.inc > @@ -199,3 +199,10 @@ CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed > from v6.18.3" > # https://ubuntu.com/security/CVE-2019-14899 > CVE_STATUS[CVE-2019-14899] = "unpatched: consequence of the default weak \ > host model, no upstream kernel fix, mitigated by firewall configuration" > + > +# Timing side channel inherent to KSM page deduplication. Reachable only > +# when ksmd is started (/sys/kernel/mm/ksm/run defaults to 0) and the > +# workload opts in via MADV_MERGEABLE or prctl(PR_SET_MEMORY_MERGE). > +# https://security-tracker.debian.org/tracker/CVE-2021-3714 > +CVE_STATUS[CVE-2021-3714] = "unpatched: timing side channel inherent to \ > +KSM page deduplication, only reachable when KSM is enabled and opted into" I recommend we change the wording, add more links and include the triage date: # Triaged August 2026 - no upstream fix, Debian says "Inherent design # limitation, can be avoided by not using KSM", Red Hat closed their bug as # WONTFIX. # https://security-tracker.debian.org/tracker/CVE-2021-3714 # https://bugzilla.redhat.com/show_bug.cgi?id=1931327 # https://ubuntu.com/security/CVE-2021-3714 CVE_STATUS[CVE-2021-3714] = "unpatched: Timing side channel inherent to Kernel \ Same-page Merging (KSM) page deduplication" Best regards, -- Paul Barker
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#243529): https://lists.openembedded.org/g/openembedded-core/message/243529 Mute This Topic: https://lists.openembedded.org/mt/120714049/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
