Linux Kernel IPI Usage Vulnerability in KFENCE Page Protection

A vulnerability in the Linux kernel's handling of Inter-Processor Interrupts (IPIs) during memory protection operations has been identified. This issue arises in the RISC-V architecture when the 'flush_tlb_kernel_range()' function uses IPIs to clear the Translation Lookaside Buffers (TLBs) of all cores. Such a broadcast can trigger a warning if interrupts are disabled, indicating a potential mishandling of CPU communication. The vulnerability is linked to the 'KFENCE' memory safety feature, which aims to protect against memory corruption errors.

Impact

The vulnerability could lead to improper handling of memory protection, potentially allowing memory corruption issues to go unaddressed, which could be exploited to cause instability or errors in the system.

Reproduction

The vulnerability can be reproduced by using the 'flush_tlb_kernel_range()' function in a scenario where interrupts are disabled. This can be done by calling the function from a context that prevents IRQs from being processed, such as during certain kernel operations or in a specific CPU state. The warning about the improper IPI usage will indicate that the vulnerability has been triggered.

Remediation

Users can upgrade to the latest stable version of the Linux kernel where this vulnerability has been addressed. Consult the official Linux kernel documentation or resources for guidance on upgrading.