CVE-2024-52319 mm: use aligned address in clear_gigantic_page()
A memory corruption vulnerability in the Linux kernel's huge page handling allows attackers to potentially execute code or leak sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-52319?
CVE-2024-52319 is a high-severity memory corruption vulnerability in Linux kernel, published on 11 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm: use aligned address in clear_gigantic_page()
In current kernel, hugetlb_no_page() calls folio_zero_user() with the fault address. Where the fault address may be not aligned with the huge page size. Then, folio_zero_user() may call clear_gigantic_page() with the address, while clear_gigantic_page() requires the address to be huge page size aligned. So, this may cause memory corruption or information leak, addtional, use more obvious naming 'addr_hint' instead of 'addr' for clear_gigantic_page().
Weakness: CWE-787
Which versions are affected by CVE-2024-52319?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-52319?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-52319 being exploited?
There is no known exploitation of CVE-2024-52319 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-52319, DEBIAN-CVE-2024-52319, GHSA-6c46-29xx-f8w2, UBUNTU-CVE-2024-52319.