CVE-2024-0564

What it actually does

The flaw enables a local side-channel attack against Kernel Samepage Merging (KSM) by allowing an attacker to time page unmap operations and observe whether merges occur beyond the default max_page_sharing=256 limit, thereby leaking contents of victim pages on the same host.

Why it matters to the business

Co-located workloads on shared Linux hosts face risk of sensitive memory contents being disclosed to an attacker on the same system, which can expose credentials, keys, or application data across tenants or containers.

How an attack unfolds

An attacker on the same physical host as a victim process crafts memory pages that can merge with the victim's via KSM, repeatedly triggers unmaps, and measures timing differences caused by extra physical page allocations when the sharing limit is exceeded, gradually reconstructing the victim's page contents.

How to fix it

Disable KSM entirely (echo 0 > /sys/kernel/mm/ksm/run) or restrict its use via kernel command-line parameters; apply the latest vendor kernel updates that address the side-channel exposure when available; consider workload isolation to prevent attacker-victim co-location.

How to confirm the fix worked

Verify KSM is disabled or that the running kernel version contains the upstream fix; inspect /sys/kernel/mm/ksm/ settings and confirm no unprivileged processes can influence page sharing; test that timing side-channel measurements no longer leak page contents in a controlled environment.

Typical attack path

1. Gain code execution or a process on the same host as the target workload
2. Allocate and prepare candidate pages that collide with victim memory under KSM
3. Trigger repeated map/unmap operations while measuring timing of KSM merge behavior
4. Detect when merges exceed the max_page_sharing threshold to infer victim page contents
5. Reconstruct and exfiltrate leaked sensitive data from the timing observations

How to detect it

Exploitation leaves no reliable kernel audit or log artifacts; monitor for unusual KSM activity via /sys/kernel/mm/ksm/* counters or perf events related to page merges, and correlate with processes that exhibit repeated map/unmap patterns on shared hosts.

What your security team should do

• Prioritize disabling KSM on multi-tenant or container hosts where workloads from different trust boundaries share the kernel
• Apply kernel updates from distribution vendors as soon as they become available
• Review and enforce workload placement policies to avoid untrusted code sharing a host with sensitive data
• Monitor for any future EPSS or exploit maturity changes given the public exploit availability