Re: [OE-core][PATCH v3 6/9] cve-exclusions: set status for CVE-2022-4543

[Paul Barker <paul@pbarker.dev>]

On Wed, 2026-08-12 at 02:28 -0500, Junjie Cao wrote:
> KPTI clones the kernel entry text into the user page tables at its
> KASLR-slid address and, on CPUs with PGE, sets the global bit on those
> PTEs. The mapping survives the CR3 write on kernel exit, and a local
> attacker can time prefetch instructions across the kernel range to
> recover the KASLR base in well under a second.
> 
> Disclosure and write-up:
> 
>   https://www.openwall.com/lists/oss-security/2022/12/16/3
>   https://www.willsroot.io/2022/12/entrybleed.html
> 
> The disclosure states that after discussion with security@kernel.org and
> linux-distros "a fix for this is currently not available", and none has
> appeared since; arch/x86/mm/pti.c still clones the entry text and sets
> _PAGE_GLOBAL on the cloned PTEs. This is an unfixed issue, not a stated
> wontfix - Debian notes "Ignored upstream and KASLR is not expected to be
> resistant to local attacks", Ubuntu has it deferred since 2023-01-10:
> 
>   https://security-tracker.debian.org/tracker/CVE-2022-4543
>   https://ubuntu.com/security/CVE-2022-4543
> 
> 97e3d26b5e5f ("x86/mm: Randomize per-cpu entry area", v6.2) randomizes
> the separate cpu_entry_area; it predates this disclosure and does not
> change the offset of entry_SYSCALL_64 from the KASLR base.

There's too much unnecessary detail here. Drop the mention of a commit
that doesn't fix the issue, you don't need to say "not a stated
wontfix", etc.

> 
> CC: Paul Barker <paul@pbarker.dev>
> AI-Generated: Uses Claude (claude-opus-5)
> Signed-off-by: Junjie Cao <junjie.cao@linux.dev>
> ---
> v3:
> - use "unpatched" instead of "upstream-wontfix": the security-team
>   discussion produced no clear wontfix decision
> 
> v2: https://lore.kernel.org/openembedded-core/20260803084827.1348810-1-junjie.cao@linux.dev/
> 
>  meta/recipes-kernel/linux/cve-exclusion.inc | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc
> index b08eaa1..a909aef 100644
> --- a/meta/recipes-kernel/linux/cve-exclusion.inc
> +++ b/meta/recipes-kernel/linux/cve-exclusion.inc
> @@ -229,3 +229,11 @@ was never substantiated and was closed as not-a-bug by Red Hat, SUSE and Debian"
>  # Fix https://git.kernel.org/linus/d860d1faa6b2ce3becfdb8b0c2b048ad31800061
>  # Fix https://git.kernel.org/linus/da9c9c877597170b929a6121a68dcd3dd9a80f45
>  CVE_STATUS[CVE-2022-1247] = "fixed-version: Fixed from version 6.17"
> +
> +# "EntryBleed": KPTI maps the entry text into the user page tables with
> +# the global bit set, leaking the KASLR base by prefetch timing. Discussed
> +# with the kernel security team; no fix, KASLR is not treated as a boundary
> +# against local attackers. Distinct from CVE-2023-3640 (cpu_entry_area).
> +# https://www.willsroot.io/2022/12/entrybleed.html
> +CVE_STATUS[CVE-2022-4543] = "unpatched: no upstream fix, KASLR is not \
> +treated as a defence against local attackers"

Suggested wording, links and include triage date:

    # Triaged August 2026 - "EntryBleed", discussed with the kernel security team
    # but no fix appears to have been published since then. Debian says "Ignored
    # upstream and KASLR is not expected to be resistant to local attacks", fix
    # deferred in Ubuntu.
    # https://www.openwall.com/lists/oss-security/2022/12/16/3
    # https://security-tracker.debian.org/tracker/CVE-2022-4543
    # https://ubuntu.com/security/CVE-2022-4543
    CVE_STATUS[CVE-2022-4543] = "unpatched: No fix has been proposed"

Best regards,

-- 
Paul Barker