CVE-2024-35871: 
Linux Debian vulnerability analysis and mitigation

A vulnerability in the Linux kernel's RISC-V architecture implementation has been identified as CVE-2024-35871. The issue involves kernel gp (global pointer) leakage in the process handling code, where childregs represents the registers active for new threads in user context. This vulnerability was discovered in May 2024 and affects the Linux kernel's RISC-V architecture implementation (NVD).

The vulnerability stems from improper handling of the global pointer (gp) register in kernel threads and user mode helper threads. For kernel threads, childregs->gp is never used since the kernel gp is not touched by switch_to. However, for user mode helper threads, the gp value can be observed in user space after execve or through other means. The vulnerability can be exploited through multiple vectors including kernel_execve, ptrace(PTRACE_GETREGSET), /proc//task//syscall, PERF_SAMPLE_REGS_USER, and various tracing infrastructure components (Kernel Commit).

The vulnerability allows user space processes to observe kernel addresses through various mechanisms, potentially leading to information disclosure. This is particularly concerning because it bypasses LOCKDOWN_PERF restrictions, as kernel addresses can be exposed via PERF_SAMPLE_REGS_USER which is normally permitted under LOCKDOWN_PERF (Kernel Commit).

The vulnerability can be exploited through at least five different methods: 1) kernel_execve execution, 2) ptrace attachment to user_mode_helper threads, 3) accessing /proc//task//syscall, 4) using PERF_SAMPLE_REGS_USER, and 5) through various tracing infrastructure components. The issue affects user mode helper threads that execute user processes, such as /sbin/init or when /proc/sys/kernel/core_pattern is a pipe (Kernel Commit).

The vulnerability has been fixed by removing the gp_in_global register assignment and its usage in the process.c file. The fix was implemented through a patch that removes the global pointer leakage in the RISC-V process handling code. The patch has been merged into various Linux kernel versions and is available through distribution-specific updates (Ubuntu Security Notice, Debian LTS).