CVE-2024-51729

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-51729", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-01-11T12:33:33.687Z", "datePublished": "2025-01-11T12:35:38.375Z", "dateUpdated": "2026-08-05T11:43:15.492Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:43:15.492Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: use aligned address in copy_user_gigantic_page()\n\nIn current kernel, hugetlb_wp() calls copy_user_large_folio() with the\nfault address. Where the fault address may be not aligned with the huge\npage size. Then, copy_user_large_folio() may call\ncopy_user_gigantic_page() with the address, while\ncopy_user_gigantic_page() requires the address to be huge page size\naligned. So, this may cause memory corruption or information leak,\naddtional, use more obvious naming 'addr_hint' instead of 'addr' for\ncopy_user_gigantic_page()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached through a local page fault on a hugetlb mapping created by the calling process (mmap MAP_HUGETLB / hugetlbfs MAP_PRIVATE), with no network or remote component. Exploitation requires the attacker to execute code on the target system.\nAC:L - The attacker fully and deterministically controls the faulting address handed to hugetlb_wp() \u2014 simply writing to any non-huge-page-aligned offset in a private gigantic hugetlb mapping guarantees the misaligned vaddr, with no race, no timing window, and no dependence on memory layout. Gigantic hugetlb pools are a widely deployed, routinely provisioned configuration (databases, DPDK, KVM hosts).\nPR:L - Any unprivileged local user can reach the path \u2014 mmap(MAP_PRIVATE|MAP_ANONYMOUS|MAP_HUGETLB|MAP_HUGE_1GB) uses HUGETLB_ANON_FILE, which bypasses the can_do_hugetlb_shm() capability gate that only guards SHM_HUGETLB, and an open hugetlbfs file mapped MAP_PRIVATE works equally well. No CAP_IPC_LOCK, CAP_SYS_ADMIN, or root is needed.\nUI:N - The attacker triggers the COW fault entirely within its own process by writing to its own mapping; no victim action, no file to open, no filesystem to mount.\nS:U - The corruption and disclosure occur in memory managed by the same kernel security authority; no VM escape, IOMMU, or sandbox boundary is crossed by the flaw itself.\nC:H - The commit states the misalignment \"may cause memory corruption or information leak\" \u2014 on cache-aliasing architectures the wrong vaddr selects the wrong cache color in kmap_coherent()/the flush decision, so the newly allocated gigantic folio can expose residual contents of a previously-freed 1GB-scale page (another process's or a KVM guest's data) directly to the attacker's userspace mapping.\nI:H - The copy is performed through an incorrectly colored/flushed mapping across every subpage of the gigantic folio, so attacker-reachable data is silently written to or left in the wrong cache alias, corrupting up to a gigabyte of page contents including memory backing KVM guests.\nA:H - Silent corruption of an entire gigantic folio's contents \u2014 code, stack, page-table-adjacent guest RAM, or application data \u2014 leads to unpredictable faults and crashes, and can be triggered repeatedly by an unprivileged user for as long as gigantic pages remain in the pool."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/hugetlb.c", "mm/memory.c"], "versions": [{"version": "530dd9926dc16220d2fae0997f45cda94f5f0864", "lessThan": "cb12d61361ce769672c7c7bd32107252598cdd8b", "status": "affected", "versionType": "git"}, {"version": "530dd9926dc16220d2fae0997f45cda94f5f0864", "lessThan": "f5d09de9f1bf9674c6418ff10d0a40cfe29268e1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/hugetlb.c", "mm/memory.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.7", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cb12d61361ce769672c7c7bd32107252598cdd8b"}, {"url": "https://git.kernel.org/stable/c/f5d09de9f1bf9674c6418ff10d0a40cfe29268e1"}], "title": "mm: use aligned address in copy_user_gigantic_page()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/hugetlb.c", "mm/memory.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cb12d61361ce769672c7c7bd32107252598cdd8b", "status": "affected", "version": "530dd9926dc16220d2fae0997f45cda94f5f0864", "versionType": "git"}, {"lessThan": "f5d09de9f1bf9674c6418ff10d0a40cfe29268e1", "status": "affected", "version": "530dd9926dc16220d2fae0997f45cda94f5f0864", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/hugetlb.c", "mm/memory.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6ACCAC21-7ECC-4FBC-A3F6-FD71065601D7", "versionEndExcluding": "6.12.7", "versionStartIncluding": "6.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*", "matchCriteriaId": "62567B3C-6CEE-46D0-BC2E-B3717FBF7D13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*", "matchCriteriaId": "5A073481-106D-4B15-B4C7-FB0213B8E1D4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*", "matchCriteriaId": "DE491969-75AE-4A6B-9A58-8FC5AF98798F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: use aligned address in copy_user_gigantic_page()\n\nIn current kernel, hugetlb_wp() calls copy_user_large_folio() with the\nfault address. Where the fault address may be not aligned with the huge\npage size. Then, copy_user_large_folio() may call\ncopy_user_gigantic_page() with the address, while\ncopy_user_gigantic_page() requires the address to be huge page size\naligned. So, this may cause memory corruption or information leak,\naddtional, use more obvious naming 'addr_hint' instead of 'addr' for\ncopy_user_gigantic_page()."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: usar direcci\u00f3n alineada en copy_user_gigantic_page() En el kernel actual, hugetlb_wp() llama a copy_user_large_folio() con la direcci\u00f3n de error. Donde la direcci\u00f3n de error puede no estar alineada con el tama\u00f1o de p\u00e1gina enorme. Entonces, copy_user_large_folio() puede llamar a copy_user_gigantic_page() con la direcci\u00f3n, mientras que copy_user_gigantic_page() requiere que la direcci\u00f3n est\u00e9 alineada con el tama\u00f1o de p\u00e1gina enorme. Por lo tanto, esto puede causar corrupci\u00f3n de memoria o fuga de informaci\u00f3n. Adem\u00e1s, use un nombre m\u00e1s obvio 'addr_hint' en lugar de 'addr' para copy_user_gigantic_page()."}], "id": "CVE-2024-51729", "lastModified": "2026-08-04T11:21:44.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-01-11T13:15:24.650", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cb12d61361ce769672c7c7bd32107252598cdd8b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f5d09de9f1bf9674c6418ff10d0a40cfe29268e1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: mm: use aligned address in copy_user_gigantic_page()", "id": "2337125", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2337125"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "status": "draft"}, "cwe": "CWE-131", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmm: use aligned address in copy_user_gigantic_page()\nIn current kernel, hugetlb_wp() calls copy_user_large_folio() with the\nfault address. Where the fault address may be not aligned with the huge\npage size. Then, copy_user_large_folio() may call\ncopy_user_gigantic_page() with the address, while\ncopy_user_gigantic_page() requires the address to be huge page size\naligned. So, this may cause memory corruption or information leak,\naddtional, use more obvious naming 'addr_hint' instead of 'addr' for\ncopy_user_gigantic_page()."], "name": "CVE-2024-51729", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-01-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-51729\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-51729\nhttps://lore.kernel.org/linux-cve-announce/2025011143-CVE-2024-51729-799d@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-13T11:14:55.783573+00:00", "updated": "2025-07-13T11:14:55.783639+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}