CVE-2024-42258: mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines
In the Linux kernel, the following vulnerability has been resolved:
mm: hugememory: use !CONFIG64BIT to relax huge page alignment on 32 bit machines
The Linux kernel CVE team has assigned CVE-2024-42258 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024081216-CVE-2024-42258-e3f3@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
mm: hugememory: use !CONFIG64BIT to relax huge page alignment on 32 bit machines
Yves-Alexis Perez reported commit 4ef9ad19e176 ("mm: hugememory: don't force huge page alignment on 32 bit") didn't work for x8632 [1]. It is because x8632 uses CONFIGX8632 instead of CONFIG32BIT.
!CONFIG64BIT should cover all 32 bit machines.
[1] https://lore.kernel.org/linux-mm/CAHbLzkr1LwH3pcTgM+aGQ31ip2bKqiqEQ8=FQB+t2c3dhNKNHA@mail.gmail.com/
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch CVE-2024-42258 - Configuration
Update the huge page alignment logic to use '!CONFIG_64BIT' so huge page alignment is relaxed on 32-bit machines (x86_32 uses CONFIG_X86_32 instead of CONFIG_32BIT, so '!CONFIG_64BIT' is the needed condition).
Linux kernel mm: huge_memory CONFIG_64BIT = !CONFIG_64BIT
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42258?
CVE-2024-42258 is categorized as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-42258?
To fix CVE-2024-42258, update the Linux kernel to a version that includes the patch, such as those listed in the affected software section.
Which Linux kernel versions are affected by CVE-2024-42258?
CVE-2024-42258 affects Linux kernel versions from 6.8 to 6.10.3.
Is CVE-2024-42258 specific to 32-bit systems?
Yes, CVE-2024-42258 deals with huge page alignment issues specifically on 32-bit machines.
What is the impact of CVE-2024-42258 on systems using the Linux kernel?
CVE-2024-42258 can lead to potential memory mismanagement on systems using 32-bit architectures, impacting performance and stability.