CVE-2024-50112: x86/lam: Disable ADDRESS_MASKING in most cases
First published: Tue Nov 05 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: x86/lam: Disable ADDRESS_MASKING in most cases Linear Address Masking (LAM) has a weakness related to transient execution as described in the SLAM paper[1]. Unless Linear Address Space Separation (LASS) is enabled this weakness may be exploitable. Until kernel adds support for LASS[2], only allow LAM for COMPILE_TEST, or when speculation mitigations have been disabled at compile time, otherwise keep LAM disabled. There are no processors in market that support LAM yet, so currently nobody is affected by this issue. [1] SLAM: https://download.vusec.net/papers/slam_sp24.pdf [2] LASS: https://lore.kernel.org/lkml/20230609183632.48706-1-alexander.shishkin@linux.intel.com/ [ dhansen: update SPECULATION_MITIGATIONS -> CPU_MITIGATIONS ]
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | <6.6.59 | |
| Linux Kernel | >=6.7<6.11.6 | |
| Linux Kernel | =6.12-rc1 | |
| Linux Kernel | =6.12-rc2 | |
| Linux Kernel | =6.12-rc3 | |
| Linux Kernel | =6.12-rc4 | |
| debian/linux | <=5.10.223-1<=5.10.226-1<=6.1.123-1<=6.1.128-1 | 6.12.12-1 6.12.15-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/60a5ba560f296ad8da153f6ad3f70030bfa3958f
- https://git.kernel.org/stable/c/690599066488d16db96ac0d6340f9372fc56f337
- https://git.kernel.org/stable/c/3267cb6d3a174ff83d6287dcd5b0047bbd912452
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50112
- https://nvd.nist.gov/vuln/detail/CVE-2024-50112
- https://launchpad.net/bugs/cve/CVE-2024-50112
- https://security-tracker.debian.org/tracker/CVE-2024-50112
- https://ubuntu.com/security/CVE-2024-50112
- https://git.kernel.org/linus/3267cb6d3a174ff83d6287dcd5b0047bbd912452
Frequently Asked Questions
What is the severity of CVE-2024-50112?
CVE-2024-50112 is categorized as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-50112?
To fix CVE-2024-50112, update your Linux kernel version to the latest stable release that is beyond the vulnerable versions.
Which versions of the Linux kernel are affected by CVE-2024-50112?
CVE-2024-50112 affects Linux kernel versions from 6.7 to 6.6.59, including specific release candidates of 6.12.
What type of vulnerability is CVE-2024-50112 related to?
CVE-2024-50112 is related to a weakness in the Linear Address Masking mechanism tied to transient execution.
Is CVE-2024-50112 exploitable remotely?
CVE-2024-50112 may have exploitation potential depending on the system configuration and usage context.
- agent/title
- agent/type
- agent/first-publish-date
- agent/author
- agent/remedy
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/usn-cve
- source/Ubuntu
- collector/security-tracker-debian
- source/Debian
- agent/references
- agent/source
- agent/tags
- agent/description
- agent/softwarecombine
- collector/nvd-cve
- agent/event
- vendor/linux
- canonical/linux kernel
- version/linux kernel/6.7
- version/linux kernel/6.12-rc1
- version/linux kernel/6.12-rc2
- version/linux kernel/6.12-rc3
- version/linux kernel/6.12-rc4
- package-manager/debian