CVE-2024-51729

HIGH EPSS 11.1%
Published Jan 11, 20251y ago · Modified Jun 17, 20261w ago
7.8 CVSS 3.1
High
Find Similar
Published Jan 11, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in copy_user_gigantic_page() In current kernel, hugetlb_wp() calls copy_user_large_folio() with the fault address. Where the fault address may be not aligned with the huge page size. Then, copy_user_large_folio() may call copy_user_gigantic_page() with the address, while copy_user_gigantic_page() requires the address to be huge page size aligned. So, this may cause memory corruption or information leak, addtional, use more obvious naming 'addr_hint' instead of 'addr' for copy_user_gigantic_page().

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
11.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 4

VendorProductVersionRange
linuxlinux_kernel*≥6.11  –  <6.12.7
linuxlinux_kernel6.13any
linuxlinux_kernel6.13any
linuxlinux_kernel6.13any

References 2

  • git.kernel.org https://git.kernel.org/stable/c/cb12d61361ce769672c7c7bd32107252598cdd8b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f5d09de9f1bf9674c6418ff10d0a40cfe29268e1
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/cb12d61361ce769672c7c7bd32107252598cdd8b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f5d09de9f1bf9674c6418ff10d0a40cfe29268e1
    Patch