[OE-core][PATCH v3 2/9] cve-exclusions: set status for CVE-2021-3714

[Junjie Cao <junjie.cao@linux.dev>]

KSM merges identical anonymous pages across processes. An attacker who
can place chosen page-sized content in a victim's memory can detect the
merge through the timing of the resulting copy-on-write fault, and so
leak memory contents.

There is no upstream fix; removing the side channel means removing
deduplication. Distribution trackers describe it the same way - Debian
marks src:linux unfixed with "Inherent design limitation, can be avoided
by not using KSM", Red Hat closed its bug WONTFIX, and Ubuntu records no
upstream fix as of 2024-06-17:

  https://security-tracker.debian.org/tracker/CVE-2021-3714
  https://bugzilla.redhat.com/show_bug.cgi?id=1931327
  https://ubuntu.com/security/CVE-2021-3714

Exposure requires two runtime opt-ins: ksmd must be started by the
administrator (ksm_run defaults to KSM_RUN_STOP in mm/ksm.c) and memory
is only eligible when a process asks with madvise(MADV_MERGEABLE) or
prctl(PR_SET_MEMORY_MERGE). CONFIG_KSM=y is set in yocto-kernel-cache
(bsp/intel-x86 and the paravirt_kvm fragments), so this is not a
configuration exclusion.

CC: Paul Barker <paul@pbarker.dev>
AI-Generated: Uses Claude (claude-opus-5)
Signed-off-by: Junjie Cao <junjie.cao@linux.dev>
---
v3:
- use "unpatched" instead of "upstream-wontfix": the WONTFIX is a
  distribution position, not an upstream one

v2: https://lore.kernel.org/openembedded-core/20260803084827.1348810-1-junjie.cao@linux.dev/

 meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc
index 5ed4a00..af3576d 100644
--- a/meta/recipes-kernel/linux/cve-exclusion.inc
+++ b/meta/recipes-kernel/linux/cve-exclusion.inc
@@ -199,3 +199,10 @@ CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed from v6.18.3"
 # https://ubuntu.com/security/CVE-2019-14899
 CVE_STATUS[CVE-2019-14899] = "unpatched: consequence of the default weak \
 host model, no upstream kernel fix, mitigated by firewall configuration"
+
+# Timing side channel inherent to KSM page deduplication. Reachable only
+# when ksmd is started (/sys/kernel/mm/ksm/run defaults to 0) and the
+# workload opts in via MADV_MERGEABLE or prctl(PR_SET_MEMORY_MERGE).
+# https://security-tracker.debian.org/tracker/CVE-2021-3714
+CVE_STATUS[CVE-2021-3714] = "unpatched: timing side channel inherent to \
+KSM page deduplication, only reachable when KSM is enabled and opted into"
-- 
2.43.0