CVE-2017-13695

What it actually does

The acpi_ns_evaluate() function fails to flush the operand cache, producing a kernel stack dump that leaks kernel memory contents and bypasses KASLR.

Why it matters to the business

Local attackers can obtain kernel memory addresses and data, weakening memory-protection mechanisms and facilitating further attacks on affected systems.

How an attack unfolds

An attacker supplies a crafted ACPI table that triggers operand-cache leakage during namespace evaluation, resulting in a kernel stack dump containing sensitive addresses usable to defeat KASLR.

How to fix it

Upgrade falcoctl (Chainguard) to 0.7.3-r7 or later and falcoctl (Wolfi) to 0.7.3-r7 or later; apply any available kernel patches addressing the ACPI cache flush issue.

How to confirm the fix worked

Confirm installed package versions meet or exceed the fixed releases and verify that crafted ACPI tables no longer produce observable kernel stack dumps.

Typical attack path

1. Craft a malicious ACPI table
2. Load the table on a local system
3. Trigger ACPI namespace evaluation
4. Capture the resulting kernel stack dump
5. Extract leaked kernel addresses to bypass KASLR

How to detect it

Review kernel logs for unexpected stack dumps or ACPI evaluation errors around the time of suspicious local activity.

What your security team should do

• Apply the listed package updates without delay
• Audit systems for unexpected ACPI table loads
• Harden local access controls to reduce attack surface