Azure Sphere Information Disclosure Vulnerability

An attacker who has compromised an unprivileged application on the device can call `klogctl(3, buf, size)` to dump the kernel ring buffer [ref_id=1]. Because `dmesg_restrict` is 0, no special permissions are required [CWE-732]. The kernel logs can contain sensitive information such as kernel code addresses, kernel memory addresses, and userland register contents (including from the application-manager/init process) [ref_id=1]. An attacker can also trigger an OOM condition by forking an unlimited number of processes (since `RLIMIT_NPROC` is set to infinity), causing the OOM killer to log register contents of high-value target processes like application-manager into the ring buffer, which are then readable by the attacker [ref_id=1].

The vulnerability is in the Azure Sphere Linux kernel's permission assignment for the kernel message ring buffer. The sysctl file `/proc/sys/kernel/dmesg_restrict` is left set to 0, meaning unprivileged users can read kernel logs via the `klogctl` function [ref_id=1]. No patch files are included in the bundle.

The advisory does not include a patch diff, but the remediation is to set `/proc/sys/kernel/dmesg_restrict` to a non-zero value, which restricts access to the kernel ring buffer to privileged users only [ref_id=1]. This prevents unprivileged applications from calling `klogctl` to read sensitive kernel and userland memory addresses from the logs [ref_id=1]. No patch is published in the bundle.

The advisory provides a proof-of-concept. First, trigger an OOM condition by forking many child processes: loop 50 times calling `fork()`, with each child sleeping 15 seconds and then exiting, with a 100ms delay between forks. This causes the OOM killer to terminate a target process (e.g., application-manager), logging its registers. Then, read the kernel ring buffer: `char *logbuf = malloc(0x10001); klogctl(3, logbuf, 0x10000);` to leak the register contents and ASLR offsets [ref_id=1].