CVE-2024-50193

What it actually does

The flaw is in the x86 32-bit NMI return path where CPU buffers are cleared before register state restoration, violating the RDFS mitigation requirement that buffers must be cleared only after registers hold no sensitive data.

Why it matters to the business

Increases risk of register-value leakage via microarchitectural side-channel attacks on 32-bit x86 Linux systems, potentially exposing sensitive data in environments relying on MDS or RDFS mitigations; low exploitability but relevant for high-security or virtualized workloads using affected qemu packages.

How an attack unfolds

An attacker triggers an NMI on a vulnerable 32-bit x86 system; because buffers are cleared while registers may still contain secrets, the attacker uses timing or cache-based side-channel techniques to sample residual data that RDFS mitigations were intended to protect.

How to fix it

Upgrade Linux kernel to version 5.10.228 or later containing the moved CLEAR_CPU_BUFFERS after RESTORE_ALL_NMI; for qemu on Ubuntu 14.04 LTS update to package version 2.0.0+dfsg-2ubuntu1.21.

How to confirm the fix worked

Confirm running kernel contains the commit moving CLEAR_CPU_BUFFERS after RESTORE_ALL_NMI in arch/x86/entry/entry_32.S; verify qemu package version matches the fixed Ubuntu release; re-test NMI return path under MDS/RDFS mitigation enabled configurations.

Typical attack path

1. Trigger NMI via hardware or software means on target 32-bit x86 Linux kernel
2. Exploit the window where registers retain sensitive values during buffer clearing
3. Perform Register File Data Sampling or related microarchitectural side-channel read
4. Extract leaked register contents for further attack chaining

How to detect it

Review kernel logs and performance counters for anomalous NMI frequency or side-channel activity patterns; correlate with process execution involving untrusted code that could trigger NMIs; no public exploit artifacts known.

What your security team should do

• Prioritize kernel upgrades on all 32-bit x86 systems within standard change windows
• Enable or verify existing MDS/RDFS mitigations remain active post-update
• Include NMI-related paths in future kernel regression testing