CVE-2024-36347 (EntrySign): AMD Zen & Linux Kernel Vulnerabilities (USN-8257-1)

Ubuntu has released USN-8257-1, a critical security update for the Linux kernel targeting Raspberry Pi and other architectures. This advisory addresses a high-severity hardware-software interaction flaw known as EntrySign (CVE-2024-36347), alongside several other subsystem vulnerabilities.

For defenders, the EntrySign vulnerability is particularly alarming. It undermines the trust model of AMD Zen processors by allowing a privileged attacker to bypass signature verification on CPU microcode. If an attacker gains initial access (e.g., via a web shell or container escape), they can exploit this flaw to persist undetectably at the hardware level, bypassing OS-based security controls and compromising system integrity and confidentiality. Immediate patching is required to maintain the security boundary of the hardware itself.

Technical Analysis

Affected Products and Platforms:

• OS: Ubuntu Linux (specifically Raspberry Pi kernel builds, though applicable logic affects other distros using vulnerable kernels).
• Architecture: AMD Zen processors (x86), alongside fixes for MIPS, PowerPC, and User-Mode Linux (UML).

CVE Identifier: CVE-2024-36347 (EntrySign)

Vulnerability Mechanics: The flaw resides in how the Linux kernel interacts with AMD Zen processors to load microcode. Under normal operations, the processor verifies that microcode updates are digitally signed by the vendor before loading them. Due to the EntrySign flaw, affected AMD Zen processors skip this signature verification step when instructed by the kernel.

Attack Vector:

1. Initial Access: The attacker must already have privileged access (root capabilities) on the target system. This is often achieved through a secondary vulnerability, misconfiguration, or credential theft.
2. Microcode Injection: The attacker invokes the microcode loading mechanism (via kernel interfaces or specific MSR writes) to inject arbitrary, malicious microcode into the CPU.
3. Impact: Because the microcode is trusted by the hardware above the OS, the attacker can execute malicious instructions with kernel-level (or hypervisor-level) privileges, completely subverting the operating system's security visibility. This leads to a total loss of integrity and confidentiality.

Exploitation Status: Currently, the exploitation is considered theoretical in the wild but technically feasible given the requirements. There is no active widespread exploitation reported at this time, but the barrier to entry is low for sophisticated actors who already have root access.

Detection & Response

Detecting this vulnerability requires identifying attempts to manipulate CPU Model Specific Registers (MSRs) or load microcode outside of standard boot procedures. Since the attack requires root privileges, standard EDR may be blind to the actual microcode loading, but we can detect the tools and mechanisms often used to facilitate this (e.g., msr-tools).

Sigma Rules

The following Sigma rules detect the execution of utilities used to write to MSRs (a prerequisite for manual microcode manipulation) and suspicious access to CPU device nodes.

---
title: Potential CPU Microcode Manipulation via MSR Tools
id: 8a4b2c1d-9e3f-4a5b-8c6d-1e2f3a4b5c6d
status: experimental
description: Detects the execution of tools like 'wrmsr' or 'rdmsr' which are used to write to Model Specific Registers, a technique often associated with microcode manipulation or hardware subversion like EntrySign.
references:
  - https://ubuntu.com/security/notices/USN-8257-1
author: Security Arsenal
date: 2025/04/10
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/wrmsr'
      - '/rdmsr'
    or
    CommandLine|contains:
      - 'wrmsr'
      - 'rdmsr'
  condition: selection
falsepositives:
  - Legitimate system diagnostics or hardware benchmarking (rare in production servers)
level: high
---
title: Suspicious Access to CPU MSR Device Files
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects processes attempting to read from or write to /dev/cpu/*/msr, which indicates direct interaction with CPU Model Specific Registers potentially used for exploitation.
references:
  - https://ubuntu.com/security/notices/USN-8257-1
author: Security Arsenal
date: 2025/04/10
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - '/dev/cpu/'
      - '/msr'
  filter_legit:
    Image|endswith:
      - '/udevadm'
      - '/systemd-udevd'
  condition: selection and not filter_legit
falsepositives:
  - Hardware monitoring tools (e.g., lm-sensors) if configured to read MSRs directly
level: medium

KQL (Microsoft Sentinel / Defender)

This query hunts for the execution of MSR manipulation tools ingested via Syslog or Linux agents.

// Hunt for MSR manipulation tool execution
Syslog
| where ProcessName has_any ("wrmsr", "rdmsr") 
    or ProcessCommandLine has_any ("wrmsr", "rdmsr", "/dev/cpu/", "/msr")
| extend HostName = Computer, ProcessUser = UserName
| project TimeGenerated, HostName, ProcessUser, ProcessName, ProcessCommandLine, SyslogMessage
| sort by TimeGenerated desc

Velociraptor VQL

This VQL artifact hunts for the presence of msr-tools binaries or active processes interacting with CPU device nodes.

-- Hunt for MSR manipulation tools and suspicious device access
SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe, 
  Username 
FROM pslist()
WHERE Name =~ 'wrmsr' 
   OR Name =~ 'rdmsr' 
   OR CommandLine =~ '/dev/cpu'

Remediation Script (Bash)

This script checks if the system is vulnerable by inspecting the kernel version and installed packages, then applies the necessary updates for USN-8257-1.

#!/bin/bash
# Remediation script for USN-8257-1 (CVE-2024-36347)
# Checks for available security updates for linux-image packages

echo "[*] Checking for Linux kernel security updates (USN-8257-1)..."

# Update package lists
echo "[*] Updating package lists..."
sudo apt-get update -qq

# Check if specific linux-image packages are upgradable
# We look for any linux-image package that is marked for upgrade
UPGRADABLE=$(apt-get -s upgrade | grep -E '^Inst linux-image')

if [ -n "$UPGRADABLE" ]; then
    echo "[!] Vulnerable kernel packages detected. Update required."
    echo "[+] Applying security updates..."
    sudo apt-get install -y --only-upgrade linux-image-generic linux-image-raspi
    
    echo "[!] A system reboot is REQUIRED to load the new secure kernel."
    read -p "Reboot now? (y/n) " -n 1 -r
    echo
    if [[ $REPLY =~ ^[Yy]$ ]]; then
        sudo reboot
    fi
else
    echo "[+] No kernel security updates found. System may be patched."
    echo "[*] Current Kernel Release:"
    uname -r
fi

Remediation

To mitigate CVE-2024-36347 and the associated vulnerabilities in USN-8257-1, administrators must apply the vendor patches immediately.

1. Update the Kernel:

Update the `linux-image` packages to the versions specified in the USN-8257-1 advisory.

sudo apt-get update
sudo apt-get install linux-image-generic linux-image-raspi


**2. Reboot the System:**
A system reboot is mandatory to load the patched kernel and initialize the corrected microcode verification logic.

**3. Verify Patching:**

After rebooting, verify the kernel version matches the patched versions listed in the official advisory.

Official Advisory: Ubuntu USN-8257-1

Workarounds: There are no effective software workarounds for the EntrySign flaw other than patching the kernel and rebooting. Restricting root access (e.g., enforcing sudo, removing unnecessary SUID binaries) is critical to prevent the initial privilege escalation required to trigger this vulnerability.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub