Summary
An ARM64 MMU memory-domain implementation can reuse an address space identifier (ASID) while another live domain still uses it. Because cached, non-global TLB entries can then be associated with the wrong domain, a user-mode thread may access memory belonging to another domain under its own permissions.
An ARM64 MMU memory-domain implementation can reuse an address space identifier (ASID) while another live domain still uses it. Because cached, non-global TLB entries can then be associated with the wrong domain, a user-mode thread may access memory belonging to another domain under its own permissions.
Affected context
The issue occurs in ARM64 systems using memory domains with a limited ASID space. It becomes relevant when an application creates and destroys enough domains for the ASID allocation counter to wrap while earlier domains remain live. The risk is increased on SMP systems, where domains sharing an ASID may be active on separate CPUs.
The issue occurs in ARM64 systems using memory domains with a limited ASID space. It becomes relevant when an application creates and destroys enough domains for the ASID allocation counter to wrap while earlier domains remain live. The risk is increased on SMP systems, where domains sharing an ASID may be active on separate CPUs.
Exploit preconditions
- Attack surface: ARM64 MMU memory-domain management and context switching
- Required access: A CONFIG_USERSPACE application must be able to create more than 255 memory domains over its lifetime; the domain-management APIs themselves are supervisor-only
- Trigger point: Creation of a new memory domain after ASID allocation wraps while a previous domain retains the same ASID
- Why exploitation is possible: Non-global domain mappings rely on the ASID to distinguish cached translations, but duplicate live ASIDs can leave stale translations usable across domain switches
- Attack surface: ARM64 MMU memory-domain management and context switching
- Required access: A CONFIG_USERSPACE application must be able to create more than 255 memory domains over its lifetime; the domain-management APIs themselves are supervisor-only
- Trigger point: Creation of a new memory domain after ASID allocation wraps while a previous domain retains the same ASID
- Why exploitation is possible: Non-global domain mappings rely on the ASID to distinguish cached translations, but duplicate live ASIDs can leave stale translations usable across domain switches
Why this happens
The underlying bug is an improper access-control failure caused by non-unique security-relevant identifiers. ASIDs distinguish cached translations for separate memory domains, but the allocator used a wrapping round-robin counter without checking whether the selected identifier was still held by a live domain. The context-switch logic also did not flush translations for every transition that could involve an aliased ASID, allowing stale entries to survive across domains. This maps to CWE-284: Improper Access Control, because the resulting TLB state can bypass the intended memory-domain boundary.
The underlying bug is an improper access-control failure caused by non-unique security-relevant identifiers. ASIDs distinguish cached translations for separate memory domains, but the allocator used a wrapping round-robin counter without checking whether the selected identifier was still held by a live domain. The context-switch logic also did not flush translations for every transition that could involve an aliased ASID, allowing stale entries to survive across domains. This maps to CWE-284: Improper Access Control, because the resulting TLB state can bypass the intended memory-domain boundary.
Potential impact
- A user-mode thread may read memory belonging to another domain
- A user-mode thread may write to another domain's partitions or thread stacks
- Memory-domain isolation guarantees could be defeated
- Application data may be disclosed or corrupted
- SMP systems could experience concurrent translation ambiguity across CPUs
- A user-mode thread may read memory belonging to another domain
- A user-mode thread may write to another domain's partitions or thread stacks
- Memory-domain isolation guarantees could be defeated
- Application data may be disclosed or corrupted
- SMP systems could experience concurrent translation ambiguity across CPUs
General mitigation guidance
Mitigation generally focuses on preserving ASID uniqueness for all live domains and failing closed when identifiers are exhausted.
Common defensive patterns include:
- Scanning active domains before assigning an ASID
- Refusing domain creation when no unused ASID remains
- Synchronizing ASID allocation and domain lifecycle operations across CPUs
- Applying complete TLB invalidation when translation-context ownership may be ambiguous
- Running user workloads with least privilege and minimizing the permissions granted to memory partitions
- Reducing reliance on reusable identifiers by using architecture-supported context-management mechanisms where available
Mitigation generally focuses on preserving ASID uniqueness for all live domains and failing closed when identifiers are exhausted.
Common defensive patterns include:
- Scanning active domains before assigning an ASID
- Refusing domain creation when no unused ASID remains
- Synchronizing ASID allocation and domain lifecycle operations across CPUs
- Applying complete TLB invalidation when translation-context ownership may be ambiguous
- Running user workloads with least privilege and minimizing the permissions granted to memory partitions
- Reducing reliance on reusable identifiers by using architecture-supported context-management mechanisms where available
How teams detect issues like this
Organizations can look for:
- Static analysis of ASID allocation paths for unchecked counter wraparound
- Code-review signals involving finite identifier reuse without live-object tracking
- Tests that create and destroy domains beyond the ASID capacity
- SMP stress tests that switch among multiple domains while observing TLB and permission behavior
- Assertions or runtime telemetry detecting duplicate ASIDs among live domains
- Policy checks requiring fail-closed behavior when security-sensitive identifiers are exhausted
Automated review tools may help identify unchecked resource reuse, missing lifecycle synchronization, and incomplete cache or TLB invalidation.
Organizations can look for:
- Static analysis of ASID allocation paths for unchecked counter wraparound
- Code-review signals involving finite identifier reuse without live-object tracking
- Tests that create and destroy domains beyond the ASID capacity
- SMP stress tests that switch among multiple domains while observing TLB and permission behavior
- Assertions or runtime telemetry detecting duplicate ASIDs among live domains
- Policy checks requiring fail-closed behavior when security-sensitive identifiers are exhausted
Automated review tools may help identify unchecked resource reuse, missing lifecycle synchronization, and incomplete cache or TLB invalidation.
