CVE-2024-53137: ARM: fix cacheflush with PAN
First published: Wed Dec 04 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: ARM: fix cacheflush with PAN It seems that the cacheflush syscall got broken when PAN for LPAE was implemented. User access was not enabled around the cache maintenance instructions, causing them to fault.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | >=6.10<6.11.10 | |
| Linux Kernel | =6.12-rc1 | |
| Linux Kernel | =6.12-rc2 | |
| Linux Kernel | =6.12-rc3 | |
| Linux Kernel | =6.12-rc4 | |
| Linux Kernel | =6.12-rc5 | |
| Linux Kernel | =6.12-rc6 | |
| Linux Kernel | =6.12-rc7 | |
| debian/linux | 5.10.223-1 5.10.234-1 6.1.129-1 6.1.135-1 6.12.22-1 6.12.25-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/e6960a2ed49c9a25357817535f7cc50594a58604
- https://git.kernel.org/stable/c/ca29cfcc4a21083d671522ad384532e28a43f033
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53137
- https://nvd.nist.gov/vuln/detail/CVE-2024-53137
- https://launchpad.net/bugs/cve/CVE-2024-53137
- https://security-tracker.debian.org/tracker/CVE-2024-53137
- https://ubuntu.com/security/CVE-2024-53137
- https://git.kernel.org/linus/ca29cfcc4a21083d671522ad384532e28a43f033
Frequently Asked Questions
What is the severity of CVE-2024-53137?
CVE-2024-53137 has been classified with a low severity due to its specific impact on certain Linux kernel versions.
How do I fix CVE-2024-53137?
To fix CVE-2024-53137, update your Linux kernel to version 6.12 or newer, as well as any stable release that includes the patch.
Which Linux kernel versions are affected by CVE-2024-53137?
Linux kernel versions from 6.10 up to 6.11.10, as well as 6.12-rc1 through 6.12-rc7, are affected by CVE-2024-53137.
Is CVE-2024-53137 a remote attack vector vulnerability?
CVE-2024-53137 does not present a remote attack vector and primarily impacts local user operations.
What are the implications of CVE-2024-53137 for users?
Users running affected Linux kernel versions may experience faults during cache maintenance operations, potentially impacting system performance.
- agent/title
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- collector/launchpad-cve
- source/Launchpad
- agent/source
- agent/references
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/event
- agent/softwarecombine
- agent/tags
- collector/security-tracker-debian
- source/Debian
- collector/nvd-cve
- vendor/linux
- canonical/linux kernel
- version/linux kernel/6.10
- version/linux kernel/6.12-rc1
- version/linux kernel/6.12-rc2
- version/linux kernel/6.12-rc3
- version/linux kernel/6.12-rc4
- version/linux kernel/6.12-rc5
- version/linux kernel/6.12-rc6
- version/linux kernel/6.12-rc7
- package-manager/debian