CVE-2024-52319

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-52319", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-01-11T12:33:33.694Z", "datePublished": "2025-01-11T12:35:39.280Z", "dateUpdated": "2026-08-05T11:43:16.556Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:43:16.556Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: use aligned address in clear_gigantic_page()\n\nIn current kernel, hugetlb_no_page() calls folio_zero_user() with the\nfault address. Where the fault address may be not aligned with the huge\npage size. Then, folio_zero_user() may call clear_gigantic_page() with\nthe address, while clear_gigantic_page() requires the address to be huge\npage size aligned. So, this may cause memory corruption or information\nleak, addtional, use more obvious naming 'addr_hint' instead of 'addr' for\nclear_gigantic_page()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached through a page fault on a hugetlbfs/MAP_HUGETLB mapping in the faulting task's own address space (hugetlb_no_page() \u2192 folio_zero_user()), requiring local execution on the host. There is no network- or adjacent-reachable path into mm/memory.c's page-zeroing helpers.\nAC:L - The attacker fully and deterministically controls the misalignment \u2014 vmf->real_address is the raw faulting address, so simply touching any non-huge-page-aligned byte of the mapping on first fault reproduces the wrong cache-alias selection every time, with no race and no memory-layout guessing.\nPR:L - An ordinary unprivileged user can allocate the mapping: mmap(MAP_HUGETLB|MAP_HUGE_*) uses HUGETLB_ANONHUGE_INODE, which bypasses the can_do_hugetlb_shm() capability gate in hugetlb_file_setup(), and hugetlbfs mounts are commonly world-accessible. No capability, and no CAP_IPC_LOCK or hugetlb_shm_group membership, is needed.\nUI:N - The attacker triggers the flaw entirely on their own by faulting a mapping they created themselves; no action by any other user or administrator is required at attack time.\nS:U - The mis-zeroed page and the leaked/corrupted data both live within the same kernel-managed security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Because the gigantic folio is cleared through the wrong virtual cache alias (sparc64 clear_user_page's TLBTEMP color bit, sh's skipped __flush_purge_region), the user reads stale lines and recovers the prior contents of that physical memory \u2014 potentially hundreds of megabytes to gigabytes of another process's or KVM guest's freed hugetlb data. The fix commit explicitly cites \"information leak\".\nI:H - The fix commit explicitly states the unaligned address \"may cause memory corruption\": dirty stale aliased cache lines can be written back over the region the kernel just zeroed, silently corrupting memory in a page the kernel guarantees is zero-filled, including shared hugetlbfs pages consumed by other processes.\nA:H - Silent corruption of hugetlbfs-backed memory that callers assume is zeroed \u2014 typically KVM guest RAM or a database's shared segment on these gigantic-page deployments \u2014 reliably produces crashes and hangs in the affected workloads, and the higher value is taken given the fix commit's own \"memory corruption\" characterization."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/hugetlbfs/inode.c", "mm/memory.c"], "versions": [{"version": "78fefd04c123493bbf28434768fa577b2153c79b", "lessThan": "b79b6fe0737f233f0be1465052b7f0e75f324735", "status": "affected", "versionType": "git"}, {"version": "78fefd04c123493bbf28434768fa577b2153c79b", "lessThan": "8aca2bc96c833ba695ede7a45ad7784c836a262e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/hugetlbfs/inode.c", "mm/memory.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.7", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b79b6fe0737f233f0be1465052b7f0e75f324735"}, {"url": "https://git.kernel.org/stable/c/8aca2bc96c833ba695ede7a45ad7784c836a262e"}], "title": "mm: use aligned address in clear_gigantic_page()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/hugetlbfs/inode.c", "mm/memory.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b79b6fe0737f233f0be1465052b7f0e75f324735", "status": "affected", "version": "78fefd04c123493bbf28434768fa577b2153c79b", "versionType": "git"}, {"lessThan": "8aca2bc96c833ba695ede7a45ad7784c836a262e", "status": "affected", "version": "78fefd04c123493bbf28434768fa577b2153c79b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/hugetlbfs/inode.c", "mm/memory.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6ACCAC21-7ECC-4FBC-A3F6-FD71065601D7", "versionEndExcluding": "6.12.7", "versionStartIncluding": "6.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*", "matchCriteriaId": "62567B3C-6CEE-46D0-BC2E-B3717FBF7D13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*", "matchCriteriaId": "5A073481-106D-4B15-B4C7-FB0213B8E1D4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*", "matchCriteriaId": "DE491969-75AE-4A6B-9A58-8FC5AF98798F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: use aligned address in clear_gigantic_page()\n\nIn current kernel, hugetlb_no_page() calls folio_zero_user() with the\nfault address. Where the fault address may be not aligned with the huge\npage size. Then, folio_zero_user() may call clear_gigantic_page() with\nthe address, while clear_gigantic_page() requires the address to be huge\npage size aligned. So, this may cause memory corruption or information\nleak, addtional, use more obvious naming 'addr_hint' instead of 'addr' for\nclear_gigantic_page()."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: usar direcci\u00f3n alineada en clear_gigantic_page() En el kernel actual, hugetlb_no_page() llama a folio_zero_user() con la direcci\u00f3n de error. Donde la direcci\u00f3n de error puede no estar alineada con el tama\u00f1o de p\u00e1gina enorme. Entonces, folio_zero_user() puede llamar a clear_gigantic_page() con la direcci\u00f3n, mientras que clear_gigantic_page() requiere que la direcci\u00f3n est\u00e9 alineada con el tama\u00f1o de p\u00e1gina enorme. Por lo tanto, esto puede causar corrupci\u00f3n de memoria o fuga de informaci\u00f3n. Adem\u00e1s, use un nombre m\u00e1s obvio 'addr_hint' en lugar de 'addr' para clear_gigantic_page()."}], "id": "CVE-2024-52319", "lastModified": "2026-08-04T11:21:44.887", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-01-11T13:15:24.843", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8aca2bc96c833ba695ede7a45ad7784c836a262e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b79b6fe0737f233f0be1465052b7f0e75f324735"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: mm: use aligned address in clear_gigantic_page()", "id": "2337122", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2337122"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-130", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmm: use aligned address in clear_gigantic_page()\nIn current kernel, hugetlb_no_page() calls folio_zero_user() with the\nfault address. Where the fault address may be not aligned with the huge\npage size. Then, folio_zero_user() may call clear_gigantic_page() with\nthe address, while clear_gigantic_page() requires the address to be huge\npage size aligned. So, this may cause memory corruption or information\nleak, addtional, use more obvious naming 'addr_hint' instead of 'addr' for\nclear_gigantic_page()."], "name": "CVE-2024-52319", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-01-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-52319\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-52319\nhttps://lore.kernel.org/linux-cve-announce/2025011143-CVE-2024-52319-61ca@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-12T22:31:31.529201+00:00", "updated": "2025-07-12T22:31:31.529313+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}