CVE-2022-4543 — Sensitive Information Exposure in Linux

CWE-200 — Sensitive Information ExposureCWE-203 — Observable DiscrepancyCWE-385 — Covert Timing Channel7 documents7 sources
Severity
5.5MEDIUMNVD
EPSS
0.3%
top 43.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
13
Debian LinuxMsrc Azl3 Kernel 6.6.104.2-4 ON Azure Linux 3.0Msrc Azl3 Kernel 6.6.112.1-2 ON Azure Linux 3.0+10 more
Timeline
PublishedJan 11

Description

A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR base via prefetch side-channels based on TLB timing for Intel systems.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages13 packages

🔴Vulnerability Details

2
OSV
CVE-2022-4543: A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI)↗2023-01-11
▶
GHSA
GHSA-252r-7vwr-8rfh: A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI)↗2023-01-11
▶

📋Vendor Advisories

3
Microsoft
A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR base via prefetch side-channels based on TLB timing for Intel↗2023-01-10
▶
Red Hat
kernel: KASLR Prefetch Bypass Breaks KPTI↗2022-12-19
▶
Debian
CVE-2022-4543: linux - A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KP...↗2022
▶

💬Community

1
Bugzilla
CVE-2022-4543 kernel: KASLR Prefetch Bypass Breaks KPTI↗2022-12-15
▶