CVE-2024-53241 x86/xen: don't do PV iret hypercall through hypercall page
A flaw in the Linux kernel's Xen PV implementation allowed bypassing speculation mitigations via hypercall page usage, requiring a patch to enforce direct assembly sequences.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53241?
CVE-2024-53241 is a medium-severity vulnerability in Linux kernel, published on 24 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
x86/xen: don't do PV iret hypercall through hypercall page
Instead of jumping to the Xen hypercall page for doing the iret hypercall, directly code the required sequence in xen-asm.S.
This is done in preparation of no longer using hypercall page at all, as it has shown to cause problems with speculation mitigations.
This is part of XSA-466 / CVE-2024-53241.
Which versions are affected by CVE-2024-53241?
It affects 1 product.
Linux distribution packages (3)
xen SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 4.18.4_02-150600.3.15.2 |
xen SUSE:Linux Enterprise Module for Server Applications 15 SP6 | All versions | 4.18.4_02-150600.3.15.2 |
xen openSUSE:Leap 15.6 | All versions | 4.18.4_02-150600.3.15.2 |
Products include Linux kernel.
How do I fix CVE-2024-53241?
Apply the vendor's patch.
Is CVE-2024-53241 being exploited?
There is no known exploitation of CVE-2024-53241 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-53241, DEBIAN-CVE-2024-53241, GHSA-w2vx-fp9q-36ph, ROOT-OS-UBUNTU-2204-CVE-2024-53241, SUSE-SU-2025:0142-1, UBUNTU-CVE-2024-53241.