CVE-2022-4543

What it actually does

Local unprivileged code can measure TLB prefetch timing on Intel CPUs to leak the KASLR base address, bypassing KPTI isolation and revealing kernel memory layout.

Why it matters to the business

Attackers who already have a local foothold can obtain information that makes kernel-level privilege escalation and other memory-corruption attacks far more reliable, increasing the chance of full system compromise and data theft.

How an attack unfolds

An attacker with local shell access compiles or runs a small user-space program that repeatedly accesses chosen virtual addresses and times the TLB behavior; the resulting side-channel data reveals the randomized kernel base, which is then fed into subsequent exploits that require that knowledge.

How to fix it

Upgrade to a Linux kernel that contains the KPTI and prefetch mitigations released after disclosure; apply vendor-supplied kernel packages as soon as they become available. Where immediate patching is impossible, restrict untrusted local code execution and consider CPU microcode updates that alter prefetch behavior.

How to confirm the fix worked

Confirm the running kernel version is newer than the vulnerable range listed by the distribution; test with the public EntryBleed proof-of-concept to verify that the KASLR leak is no longer observable.

Typical attack path

1. Obtain local user execution (shell, container escape, or malicious binary).
2. Execute the EntryBleed timing primitive to recover the KASLR offset.
3. Combine the leaked base with a separate kernel vulnerability to bypass ASLR and achieve privilege escalation or arbitrary code execution.

How to detect it

Examine process execution logs and audit records for repeated execution of timing-sensitive loops or prefetch instructions by untrusted users; correlate with any subsequent kernel exploits that succeed immediately after such activity.

What your security team should do

• Prioritize kernel updates on all Intel-based Linux systems that allow untrusted local users.
• Review host and container policies to minimize local code execution by non-privileged accounts.
• Monitor vendor security advisories for backported fixes and schedule rapid rollout.