CVE-2024-51729 mm: use aligned address in copy_user_gigantic_page()
An attacker can trigger memory corruption or information leaks in the Linux kernel by exploiting unaligned address handling in huge page copying.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-51729?
CVE-2024-51729 is a high-severity memory corruption vulnerability in Linux kernel, published on 11 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm: use aligned address in copy_user_gigantic_page()
In current kernel, hugetlb_wp() calls copy_user_large_folio() with the fault address. Where the fault address may be not aligned with the huge page size. Then, copy_user_large_folio() may call copy_user_gigantic_page() with the address, while copy_user_gigantic_page() requires the address to be huge page size aligned. So, this may cause memory corruption or information leak, addtional, use more obvious naming 'addr_hint' instead of 'addr' for copy_user_gigantic_page().
Weakness: CWE-787
Which versions are affected by CVE-2024-51729?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-51729?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-51729 being exploited?
There is no known exploitation of CVE-2024-51729 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-51729, DEBIAN-CVE-2024-51729, GHSA-8vm3-pfrg-f6xg, UBUNTU-CVE-2024-51729.