CVE-2023-50431

What it actually does

The sec_attest_info function in the Habanalabs driver fails to initialize the pad0 field of the returned structure before copying it to user space, resulting in leakage of uninitialized kernel stack or heap data.

Why it matters to the business

Attackers with local access on affected Linux systems can obtain fragments of kernel memory that may contain sensitive data such as credentials or encryption keys, increasing the risk of credential theft or further privilege escalation.

How an attack unfolds

An attacker compiles or loads a small program that invokes the habanalabs sec_attest_info ioctl, reads the returned structure, and extracts any leftover kernel data present in the uninitialized pad0 field; repeated calls can increase the chance of capturing useful bytes.

How to fix it

Upgrade the Linux kernel to a version containing commit a9f07790a4b2250f0140e9a61c7f842fd9b618c7 or later; rebuild and deploy the updated kernel across all affected hosts.

How to confirm the fix worked

Confirm the running kernel contains commit a9f07790a4b2250f0140e9a61c7f842fd9b618c7 by checking /proc/version or the kernel build log; attempt to compile and run a test program that calls the ioctl and verify that pad0 contains only zeros.

Typical attack path

1. Obtain local user access on a system running an affected kernel version
2. Open a device handle for the Habanalabs accelerator
3. Issue the sec_attest_info ioctl and capture the returned buffer
4. Scan the pad0 bytes for useful kernel memory contents
5. Use recovered data to escalate privileges or pivot to other systems

How to detect it

Review kernel logs and audit records for repeated or unexpected calls to habanalabs ioctls from non-administrative users; examine process execution history for custom binaries performing device ioctls on Habanalabs hardware.

What your security team should do

• Prioritize kernel updates on any system exposing Habanalabs devices to untrusted local users
• Audit local user accounts and restrict access to accelerator devices via device permissions
• Monitor kernel update channels for backported fixes in distribution kernels
• Include the fixed commit hash in internal kernel build pipelines