CVE-2022-4543: Linux Kernel Information Disclosure Flaw

CVE-2022-4543 Overview

A flaw named "EntryBleed" affects the Linux Kernel Page Table Isolation (KPTI) mitigation on Intel systems. The vulnerability allows a local attacker to leak the Kernel Address Space Layout Randomization (KASLR) base address through a prefetch side-channel based on Translation Lookaside Buffer (TLB) timing. KPTI was designed to isolate kernel page tables from user space to prevent Meltdown-class attacks. EntryBleed demonstrates that kernel entry trampolines remain mapped in user-mode page tables, exposing timing differences that reveal kernel addresses. The issue is tracked under [CWE-200] Information Exposure and [CWE-203] Observable Discrepancy. Successful exploitation undermines KASLR, a foundational defense against kernel exploitation.

Critical Impact
A local unprivileged attacker can defeat KASLR on Intel Linux systems, exposing the kernel base address to facilitate further kernel exploitation.

Affected Products

Linux Kernel on Intel x86_64 platforms with KPTI enabled
Distributions shipping vulnerable kernel builds prior to applicable patches
Systems relying on KASLR as a defense-in-depth mitigation

Discovery Timeline

2022-12-16 - Public discussion posted to the Openwall oss-security mailing list
2023-01-11 - CVE-2022-4543 published to NVD
2025-04-08 - Last updated in NVD database

Technical Details for CVE-2022-4543

Vulnerability Analysis

EntryBleed targets the boundary between user space and kernel space on Intel processors running Linux with KPTI. KPTI maintains separate page tables for user and kernel modes to prevent speculative reads of kernel memory. However, a small set of kernel entry trampolines must remain mapped in the user page tables so that the CPU can transition into the kernel during syscalls and interrupts.

An attacker measures execution latency of the prefetch instruction against candidate kernel addresses. Addresses that are present in the TLB return faster than uncached addresses. By sweeping the canonical kernel virtual address range and timing each probe, the attacker identifies the address corresponding to the kernel entry code. That address reveals the KASLR base offset.

Root Cause

The root cause is an architectural side effect of KPTI on Intel CPUs. The prefetch instruction operates on the user page tables but still updates microarchitectural state in ways that reflect kernel-side mappings of the entry trampoline. Because the trampoline location is deterministic relative to the kernel base, leaking its address discloses the KASLR slide.

Attack Vector

Exploitation requires local code execution as an unprivileged user. The attacker issues syscall instructions to populate the TLB with the kernel entry trampoline, then uses rdtsc to time prefetch operations against kernel address candidates. The technique does not require speculative execution gadgets and runs reliably on stock Intel hardware. See the Willsroot Vulnerability Analysis and the Openwall OSS Security Discussion for full technical details.

Detection Methods for CVE-2022-4543

Indicators of Compromise

Unprivileged processes executing tight loops combining syscall and prefetch instructions against high canonical virtual addresses
Repeated rdtsc or rdtscp calls correlated with prefetch probes across a large address range
User-mode binaries that scan addresses above 0xffffffff80000000 on Intel systems

Detection Strategies

Hunt for processes that combine high-frequency timing instructions with kernel-range address probing
Monitor for short-lived unprivileged binaries performing microarchitectural measurement workloads
Correlate KASLR-leak attempts with subsequent attempts to load kernel modules or trigger known kernel exploits

Monitoring Recommendations

Enable kernel auditing (auditd) for suspicious process execution patterns on multi-tenant Intel hosts
Collect telemetry on processes accessing /proc/kallsyms, dmesg, and other KASLR-relevant interfaces in conjunction with timing primitives
Track kernel version and KPTI status across the fleet to identify hosts that remain exposed

How to Mitigate CVE-2022-4543

Immediate Actions Required

Update to a patched Linux kernel that mitigates EntryBleed by randomizing or unmapping the entry trampoline location
Restrict local code execution on shared and multi-tenant Intel systems to trusted users only
Treat KASLR as defense-in-depth rather than a primary security boundary in threat models

Patch Information

Upstream Linux maintainers addressed EntryBleed by changing how the kernel entry trampoline is mapped so that its location no longer trivially discloses the KASLR base. Apply the kernel update provided by your Linux distribution vendor. Refer to the Openwall OSS Security Discussion for the patch series and distribution status.

Workarounds

Limit shell and code execution access on Intel servers to reduce the local attack surface
Disable or restrict unprivileged access to high-resolution timers where operationally feasible
Pair KASLR with additional kernel hardening such as CONFIG_RANDOMIZE_MEMORY and SMAP/SMEP enforcement

bash

# Verify kernel version and KPTI status on Intel hosts
uname -r
grep -E 'pti|cpu_meltdown' /sys/devices/system/cpu/vulnerabilities/meltdown
cat /proc/cmdline | tr ' ' '\n' | grep -i pti