CVE-2015-2877

Published: 3 March 2017

** DISPUTED ** Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat the ASLR protection mechanism on other guest OS instances via a Cross-VM ASL INtrospection (CAIN) attack. NOTE: the vendor states "Basically if you care about this attack vector, disable deduplication." Share-until-written approaches for memory conservation among mutually untrusting tenants are inherently detectable for information disclosure, and can be classified as potentially misunderstood behaviors rather than vulnerabilities.

Notes

The behavior represented by CVE-2015-2877 is inherent to Kernel
Samepage Merging. To mitigate the issue, follow the steps above to disable
KSM.

Mitigation

If qemu-kvm is installed, set KSM_ENABLED=0 in /etc/default/qemu-kvm,
otherwise will need to
  echo -n 0 > /sys/kernel/mm/ksm/run

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2877
• https://www.usenix.org/conference/woot15/workshop-program/presentation/barresi
• http://www.antoniobarresi.com/security/cloud/2015/07/30/cain/
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-2877
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1484792