CVE-2022-50720
APIC Mode Lock Bypass in Linux Kernel Risks SGX Data Leak
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the Linux kernel's handling of the APIC (Advanced Programmable Interrupt Controller) modes, specifically the x2APIC mode. The APIC supports two modes: legacy APIC (xAPIC) and extended APIC (x2APIC). The x2APIC mode disables the memory-mapped APIC interface in favor of one using MSRs. The vulnerability arises because the kernel could disable x2APIC mode even if it was locked by the BIOS, which could lead to a general protection fault (GP fault). Additionally, the legacy APIC MMIO interface has known issues, such as the APIC LEAK, which allows attackers to extract data from SGX enclaves. The fix introduces a new MSR (IA32_XAPIC_DISABLE_STATUS) to detect if the APIC is locked in x2APIC mode and prevents the kernel from disabling it improperly.
How can this vulnerability impact me? :
If the kernel disables the x2APIC mode when it is locked by the BIOS, it can cause a general protection fault, potentially leading to system instability or crashes. Moreover, the legacy APIC MMIO interface has a known vulnerability (APIC LEAK) that can be exploited to extract sensitive data from SGX enclaves, which could lead to data leakage or compromise of secure environments.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that the BIOS locks the APIC in x2APIC mode by setting the LEGACY_XAPIC_DISABLED bit via the IA32_XAPIC_DISABLE_STATUS MSR. If your platform requires legacy APIC mode, you must disable SGX and TDX in the BIOS. This prevents the kernel from disabling x2APIC mode and avoids the associated security risk.