CVE-2024-11263: arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=y
Published Nov 15, 2024
·Updated
When the Global Pointer (GP) relative addressing is enabled (CONFIGRISCVGP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.
Affected Software
1 affected component
zephyrproject zephyr<=3.7.0
Remediation
Event History
Nov 15, 2024
CVE Published
via MITRE·10:53 PM
Data Sourced
via MITRE·10:53 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-11263?
CVE-2024-11263 is rated as a medium severity vulnerability.
2
How do I fix CVE-2024-11263?
To fix CVE-2024-11263, ensure that the Global Pointer relative addressing is disabled in your configuration.
3
Which versions of Zephyr are affected by CVE-2024-11263?
CVE-2024-11263 affects Zephyr versions up to and including 3.7.0.
4
What impact does CVE-2024-11263 have on affected systems?
CVE-2024-11263 can lead to incorrect addressing for global symbols due to misconfigured Global Pointer usage.
5
Is there a workaround for CVE-2024-11263?
A potential workaround for CVE-2024-11263 is to adjust your software's memory management settings.