CVE-2024-35871 is a vulnerability identified in the Linux kernel specifically affecting the RISC-V architecture. The issue revolves around improper handling of the kernel global pointer (gp) register leakage in the context of user_mode_helper threads and kernel threads. The vulnerability arises because the childregs structure, which represents the register state for new threads in user context, does not properly clear or isolate the kernel gp register value before transitioning to user mode. This leads to a scenario where the kernel's global pointer value can be observed from user space after an execve system call or through other mechanisms such as ptrace, /proc filesystem interfaces, and performance tracing tools. The root cause is that kernel_execve does not clear integer registers fully, leaving the gp register containing kernel addresses exposed to user processes started by the kernel, including PID 1 and other user processes initiated via user_mode_helper threads. These threads, unlike pure kernel threads, do not have the PF_KTHREAD flag set and are valid targets for ptrace and other debugging/tracing mechanisms even before they execute the user process. Multiple vectors exist for observing this leakage: ptrace with PTRACE_GETREGSET can attach before execve completes, /proc/*/task/*/syscall can read pt_regs for user_mode_helpers, PERF_SAMPLE_REGS_USER can expose kernel addresses due to LOCKDOWN_PERF limitations, and various tracing infrastructures may allow access to these registers. Although no known exploits are reported in the wild, the exposure of kernel pointers to user space can facilitate kernel address space layout information disclosure, which is a critical step in bypassing kernel-level security mechanisms such as Kernel Address Space Layout Randomization (KASLR). This can enable further privilege escalation or kernel exploitation attacks. The vulnerability is specific to Linux kernel versions containing the affected commit hashes (noted as identical hashes in the report) and primarily impacts systems running on RISC-V architecture. The patch addresses the issue by properly clearing the gp register in the childregs structure before transitioning to user mode, preventing kernel pointer leakage. Impact: For European organizations, this vulnerability poses a significant risk especially for those running Linux-based infrastructure on RISC-V hardware, which is increasingly adopted in embedded systems, IoT devices, and specialized computing environments. The leakage of kernel pointers can be leveraged by attackers with local access to escalate privileges or bypass kernel security features, potentially leading to full system compromise. This is particularly critical in sectors with high security requirements such as finance, government, telecommunications, and critical infrastructure. The vulnerability also affects debugging and tracing tools, which are commonly used in development and production environments, increasing the attack surface. Mitigation: Organizations should prioritize patching Linux kernels on RISC-V systems to the fixed versions that clear the gp register appropriately. Since no known exploits exist, immediate patching can prevent future exploitation. Additionally, restricting access to ptrace and /proc interfaces to trusted users only, enforcing strict permissions on performance tracing tools, and enabling kernel lockdown features where applicable can reduce the risk of information leakage. Monitoring for unusual ptrace or tracing activity may help detect exploitation attempts. For environments where patching is delayed, consider isolating vulnerable systems and limiting user access to reduce exposure. Affected European countries are those with significant deployment of Linux on RISC-V or embedded systems, including Germany, France, the Netherlands, Sweden, and the UK, which have strong technology sectors and early adoption of emerging architectures. Countries with critical infrastructure relying on Linux-based embedded devices, such as Finland and Norway, are also at risk. Historical attack patterns show that attackers target regions with advanced technology adoption and critical infrastructure, making these countries more likely targets. Geopolitical factors such as tensions involving cyber espionage and critical infrastructure protection further elevate risk in these nations. Suggested severity for this vulnerability is high due to the potential for kernel pointer leakage facilitating privilege escalation, the ease of local exploitation without requiring user interaction, and the broad impact on confidentiality and integrity of affected systems. Although availability impact is limited, the risk to system security is substantial.

The vulnerability allows local attackers to leak kernel pointers via the gp register in user_mode_helper threads, undermining kernel address space layout randomization (KASLR) and other kernel security mechanisms. This leakage can facilitate privilege escalation and kernel exploitation, potentially leading to full system compromise. For European organizations, especially those using Linux on RISC-V architectures in critical infrastructure, embedded systems, or specialized computing environments, this represents a significant security risk. The exposure of kernel memory addresses can enable attackers to bypass security controls, threatening confidentiality and integrity of sensitive data and systems. The vulnerability also increases the attack surface by exposing kernel information through common debugging and tracing interfaces, which are widely used in development and production environments. Although no exploits are currently known in the wild, the vulnerability's presence in foundational Linux components means that exploitation could have widespread and severe consequences if weaponized.

1. Apply the official Linux kernel patches that clear the gp register in the childregs structure for all affected RISC-V systems as soon as possible. 2. Restrict access to ptrace and /proc interfaces to trusted users only, using appropriate Linux security modules (e.g., SELinux, AppArmor) or kernel lockdown features. 3. Limit permissions and usage of performance tracing tools (perf) to prevent unauthorized access to kernel registers. 4. Enable kernel lockdown mode where supported to reduce kernel information exposure. 5. Monitor system logs and audit ptrace, perf, and tracing activities for unusual or unauthorized access attempts. 6. Isolate vulnerable systems from untrusted users and networks until patches are applied. 7. For embedded and IoT devices running Linux on RISC-V, coordinate with vendors to ensure timely firmware updates incorporating the fix. 8. Educate system administrators and developers about the risks of kernel pointer leakage and the importance of applying security patches promptly.