Listen to this Post
The CVE-2025-38334 vulnerability in the Linux kernel’s SGX subsystem occurs when poisoned EPC pages are incorrectly considered for reclaim. Enclave pages in SGX are marked as poisoned upon memory errors but remain on the active page list. The reclaimer logic, sgx_reclaim_pages(), does not check the epc_page->poison flag before selecting pages for reclaim. During reclaim, microcode operations like EWB access page contents to encrypt and write them to non-SGX memory. SGX instructions cannot handle machine checks gracefully. Accessing a poisoned page during this process triggers a machine check that forces the executing core into a shutdown state. This leads to a kernel panic on other cores, causing a system crash and denial of service. The fix involves calling sgx_unmark_page_reclaimable() in arch_memory_failure() to remove poisoned pages from the active list, preventing reclaim attempts.
Platform: Linux Kernel
Version: Multiple kernel versions
Vulnerability: SGX poisoned reclaim
Severity: Critical
date: 2025-07-10
Prediction: Patched July 2025
What Undercode Say:
Analytics:
– `dmesg | grep sgx`
– `cat /proc/cpuinfo | grep sgx`
– arch_memory_failure() call
– sgx_unmark_page_reclaimable() function
– sgx_reclaim_pages() code
How Exploit:
- Induce memory errors
- Trigger page reclaim
- Cause kernel panic
Protection from this CVE:
- Apply kernel patch
- Update kernel version
- Disable SGX
Impact:
- Denial of service
- System crash
- Kernel panic
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
