CVE-2024-23984: Intel Processors Information Disclosure

CVE-2024-23984 Overview

CVE-2024-23984 is an information disclosure vulnerability affecting the Running Average Power Limit (RAPL) interface in certain Intel processors. The vulnerability stems from an observable discrepancy in the RAPL interface that may allow a privileged user to potentially enable information disclosure via local access. This type of side-channel vulnerability can be leveraged by attackers with elevated privileges to extract sensitive information from the processor's power management interface.

Critical Impact

A privileged local attacker could exploit observable discrepancies in the Intel RAPL interface to infer sensitive information from other processes or system components, potentially leading to data leakage or further exploitation chains.

Affected Products

• Intel Processors with RAPL interface (various generations)
• Systems running affected Intel microcode versions
• Linux systems with RAPL kernel module enabled

Discovery Timeline

• September 16, 2024 - CVE-2024-23984 published to NVD
• November 3, 2025 - Last updated in NVD database

Technical Details for CVE-2024-23984

Vulnerability Analysis

This vulnerability belongs to the class of side-channel attacks (CWE-203: Observable Discrepancy). The Intel RAPL (Running Average Power Limit) interface provides software with the ability to monitor and control power consumption of various processor domains including the CPU core, integrated GPU, and DRAM. The vulnerability arises from observable timing or power consumption discrepancies that can be measured through the RAPL interface.

An attacker with privileged local access can exploit these discrepancies to infer information about computations being performed by other processes or users on the same system. This is particularly concerning in multi-tenant environments such as cloud computing platforms or shared workstations where isolation between users is critical.

The attack requires local access with elevated privileges, making remote exploitation not directly feasible. However, the potential for information disclosure remains significant in environments where an attacker has already gained initial foothold with administrative access.

Root Cause

The root cause lies in the observable discrepancy in how the RAPL interface reports power consumption data. The RAPL Model Specific Registers (MSRs) expose power consumption information that can vary based on the computational operations being performed. By carefully monitoring these variations, an attacker can correlate power consumption patterns with specific operations, potentially revealing sensitive information about the data being processed.

This side-channel exists because the RAPL interface was designed primarily for power management and thermal monitoring, without consideration for the potential information leakage through power consumption patterns.

Attack Vector

The attack requires local access to the system with privileged user permissions. An attacker would need to:

1. Gain local access to a system with affected Intel processors
2. Obtain elevated privileges (root/administrator) to access RAPL MSRs
3. Monitor RAPL interface readings while victim processes execute sensitive operations
4. Analyze power consumption patterns to extract information through statistical correlation

The attack complexity is considered high due to the need for precise timing measurements and statistical analysis to extract meaningful information from power consumption variations. However, the potential impact on confidentiality is significant, affecting both the vulnerable system and potentially other systems sharing the same processor resources.

Detection Methods for CVE-2024-23984

Indicators of Compromise

• Unusual or excessive access to RAPL-related MSRs (/sys/class/powercap/intel-rapl/)
• Processes repeatedly reading power consumption data at high frequencies
• Unexpected privileged processes monitoring power management interfaces

Detection Strategies

• Monitor for abnormal access patterns to /sys/class/powercap/intel-rapl/ directories
• Implement audit rules for RAPL MSR access using Linux auditd
• Alert on processes that exhibit high-frequency polling of power consumption metrics
• Review system logs for unauthorized privilege escalation attempts

Monitoring Recommendations

• Configure SentinelOne to monitor process behavior around RAPL interface access
• Implement file integrity monitoring on power management sysfs entries
• Enable kernel auditing for MSR read operations on RAPL registers
• Deploy endpoint detection rules for side-channel attack patterns

How to Mitigate CVE-2024-23984

Immediate Actions Required

• Apply the latest Intel microcode updates addressing this vulnerability
• Update system firmware/BIOS to the latest version from your hardware vendor
• Restrict access to RAPL interfaces to only essential system processes
• Review and limit privileged user accounts on affected systems

Patch Information

Intel has released security guidance in Intel Security Advisory SA-01103 addressing this vulnerability. System administrators should apply the latest microcode updates provided by Intel and distribute through their operating system vendors.

For Debian-based systems, updated packages have been announced in the Debian LTS Announcement November 2024 and Debian LTS Announcement December 2024.

Workarounds

• Restrict access to /sys/class/powercap/intel-rapl/ using filesystem permissions
• Disable the intel_rapl kernel module if power monitoring is not required
• Implement strict access controls for privileged accounts
• Consider using hardware-based isolation for sensitive workloads

# Disable intel_rapl kernel module
echo "blacklist intel_rapl_msr" >> /etc/modprobe.d/blacklist-rapl.conf
echo "blacklist intel_rapl_common" >> /etc/modprobe.d/blacklist-rapl.conf

# Restrict RAPL sysfs permissions (if module is required)
chmod 600 /sys/class/powercap/intel-rapl/*/energy_uj

# Remove module if currently loaded
modprobe -r intel_rapl_msr intel_rapl_common