CVE-2024-35871

What it actually does

The vulnerability causes the kernel's global pointer (__global_pointer$) to be copied into the initial register state (childregs->gp) of user processes started via kernel_execve or user-mode helpers on RISC-V, making the kernel address observable from user space through ptrace, perf, tracing, and related interfaces before exec completes.

Why it matters to the business

On RISC-V Linux systems this address disclosure can assist attackers in bypassing kernel ASLR or constructing further exploits, increasing risk to system integrity; the affected code path is used for critical early processes such as init and core-dump handlers, amplifying potential impact in embedded, Android, and server environments.

How an attack unfolds

An attacker on a RISC-V system triggers kernel creation of a user-mode helper or calls kernel_execve, then uses permitted observation mechanisms (ptrace before exec, PERF_SAMPLE_REGS_USER, or tracing) to read the exposed gp register value containing the kernel __global_pointer$ address, which can be leveraged for follow-on attacks; no public exploit code is known and the issue is not under active exploitation by named threat actors.

How to fix it

Upgrade the Linux kernel to a version containing commit 9abc3e6f1116adb7a2d4fbb8ce20c37916976bf5 or later; rebuild and deploy the patched kernel on all RISC-V systems; verify that kernel_execve and copy_thread paths explicitly clear or sanitize integer registers including gp before returning to user space.

How to confirm the fix worked

Confirm the running kernel contains commit 9abc3e6f1116adb7a2d4fbb8ce20c37916976bf5; inspect the source for the register-clearing memset or equivalent sanitization in the RISC-V process creation paths; re-test ptrace and perf register reads on newly created user-mode helpers to ensure gp no longer contains a kernel address.

Typical attack path

1. Trigger kernel_execve or a user-mode helper thread (e.g., piped core_pattern or early init startup)
2. Attach with ptrace or enable PERF_SAMPLE_REGS_USER / tracing before the target execs
3. Read the user register set to obtain childregs->gp containing the kernel global pointer address
4. Use the leaked kernel address to defeat ASLR or chain into additional exploits

How to detect it

Monitor ptrace, perf, and tracing events on RISC-V systems for unexpected access to user register sets during early process creation; look for processes reading registers from user-mode helper threads before they exec; correlate with creation of processes via kernel_execve.

What your security team should do

• Immediately schedule kernel updates for all RISC-V production systems
• Prioritize environments running early user-mode helpers or custom core-dump pipelines
• Add RISC-V kernel builds to the standard patch-management cadence
• Review any custom tracing or performance-monitoring configurations that expose user registers