Re: [OE-core][PATCH v3 2/9] cve-exclusions: set status for CVE-2021-3714

[Paul Barker <paul@pbarker.dev>]

On Wed, 2026-08-12 at 02:28 -0500, Junjie Cao wrote:
> KSM merges identical anonymous pages across processes. An attacker who
> can place chosen page-sized content in a victim's memory can detect the
> merge through the timing of the resulting copy-on-write fault, and so
> leak memory contents.
> 
> There is no upstream fix; removing the side channel means removing
> deduplication. Distribution trackers describe it the same way - Debian
> marks src:linux unfixed with "Inherent design limitation, can be avoided
> by not using KSM", Red Hat closed its bug WONTFIX, and Ubuntu records no
> upstream fix as of 2024-06-17:
> 
>   https://security-tracker.debian.org/tracker/CVE-2021-3714
>   https://bugzilla.redhat.com/show_bug.cgi?id=1931327
>   https://ubuntu.com/security/CVE-2021-3714
> 
> Exposure requires two runtime opt-ins: ksmd must be started by the
> administrator (ksm_run defaults to KSM_RUN_STOP in mm/ksm.c) and memory
> is only eligible when a process asks with madvise(MADV_MERGEABLE) or
> prctl(PR_SET_MEMORY_MERGE). CONFIG_KSM=y is set in yocto-kernel-cache
> (bsp/intel-x86 and the paravirt_kvm fragments), so this is not a
> configuration exclusion.

We should drop this third paragraph - it's time consuming to validate.

> 
> CC: Paul Barker <paul@pbarker.dev>
> AI-Generated: Uses Claude (claude-opus-5)
> Signed-off-by: Junjie Cao <junjie.cao@linux.dev>
> ---
> v3:
> - use "unpatched" instead of "upstream-wontfix": the WONTFIX is a
>   distribution position, not an upstream one
> 
> v2: https://lore.kernel.org/openembedded-core/20260803084827.1348810-1-junjie.cao@linux.dev/
> 
>  meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc
> index 5ed4a00..af3576d 100644
> --- a/meta/recipes-kernel/linux/cve-exclusion.inc
> +++ b/meta/recipes-kernel/linux/cve-exclusion.inc
> @@ -199,3 +199,10 @@ CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed from v6.18.3"
>  # https://ubuntu.com/security/CVE-2019-14899
>  CVE_STATUS[CVE-2019-14899] = "unpatched: consequence of the default weak \
>  host model, no upstream kernel fix, mitigated by firewall configuration"
> +
> +# Timing side channel inherent to KSM page deduplication. Reachable only
> +# when ksmd is started (/sys/kernel/mm/ksm/run defaults to 0) and the
> +# workload opts in via MADV_MERGEABLE or prctl(PR_SET_MEMORY_MERGE).
> +# https://security-tracker.debian.org/tracker/CVE-2021-3714
> +CVE_STATUS[CVE-2021-3714] = "unpatched: timing side channel inherent to \
> +KSM page deduplication, only reachable when KSM is enabled and opted into"

I recommend we change the wording, add more links and include the triage
date:

    # Triaged August 2026 - no upstream fix, Debian says "Inherent design
    # limitation, can be avoided by not using KSM", Red Hat closed their bug as
    # WONTFIX.
    # https://security-tracker.debian.org/tracker/CVE-2021-3714
    # https://bugzilla.redhat.com/show_bug.cgi?id=1931327
    # https://ubuntu.com/security/CVE-2021-3714
    CVE_STATUS[CVE-2021-3714] = "unpatched: Timing side channel inherent to Kernel \
    Same-page Merging (KSM) page deduplication"

Best regards,

-- 
Paul Barker