CVE-2024-52319 (GCVE-0-2024-52319)

Vulnerability from cvelistv5 – Published: 2025-01-11 12:35 – Updated: 2026-08-05 11:43
VLAI
Title
mm: use aligned address in clear_gigantic_page()
Summary
In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in clear_gigantic_page() In current kernel, hugetlb_no_page() calls folio_zero_user() with the fault address. Where the fault address may be not aligned with the huge page size. Then, folio_zero_user() may call clear_gigantic_page() with the address, while clear_gigantic_page() requires the address to be huge page size aligned. So, this may cause memory corruption or information leak, addtional, use more obvious naming 'addr_hint' instead of 'addr' for clear_gigantic_page().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 78fefd04c123493bbf28434768fa577b2153c79b , < b79b6fe0737f233f0be1465052b7f0e75f324735 (git)
Affected: 78fefd04c123493bbf28434768fa577b2153c79b , < 8aca2bc96c833ba695ede7a45ad7784c836a262e (git)
Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.7 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/hugetlbfs/inode.c",
            "mm/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b79b6fe0737f233f0be1465052b7f0e75f324735",
              "status": "affected",
              "version": "78fefd04c123493bbf28434768fa577b2153c79b",
              "versionType": "git"
            },
            {
              "lessThan": "8aca2bc96c833ba695ede7a45ad7784c836a262e",
              "status": "affected",
              "version": "78fefd04c123493bbf28434768fa577b2153c79b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/hugetlbfs/inode.c",
            "mm/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.7",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: use aligned address in clear_gigantic_page()\n\nIn current kernel, hugetlb_no_page() calls folio_zero_user() with the\nfault address.  Where the fault address may be not aligned with the huge\npage size.  Then, folio_zero_user() may call clear_gigantic_page() with\nthe address, while clear_gigantic_page() requires the address to be huge\npage size aligned.  So, this may cause memory corruption or information\nleak, addtional, use more obvious naming \u0027addr_hint\u0027 instead of \u0027addr\u0027 for\nclear_gigantic_page()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through a page fault on a hugetlbfs/MAP_HUGETLB mapping in the faulting task\u0027s own address space (hugetlb_no_page() \u2192 folio_zero_user()), requiring local execution on the host. There is no network- or adjacent-reachable path into mm/memory.c\u0027s page-zeroing helpers.\nAC:L - The attacker fully and deterministically controls the misalignment \u2014 vmf-\u003ereal_address is the raw faulting address, so simply touching any non-huge-page-aligned byte of the mapping on first fault reproduces the wrong cache-alias selection every time, with no race and no memory-layout guessing.\nPR:L - An ordinary unprivileged user can allocate the mapping: mmap(MAP_HUGETLB|MAP_HUGE_*) uses HUGETLB_ANONHUGE_INODE, which bypasses the can_do_hugetlb_shm() capability gate in hugetlb_file_setup(), and hugetlbfs mounts are commonly world-accessible. No capability, and no CAP_IPC_LOCK or hugetlb_shm_group membership, is needed.\nUI:N - The attacker triggers the flaw entirely on their own by faulting a mapping they created themselves; no action by any other user or administrator is required at attack time.\nS:U - The mis-zeroed page and the leaked/corrupted data both live within the same kernel-managed security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Because the gigantic folio is cleared through the wrong virtual cache alias (sparc64 clear_user_page\u0027s TLBTEMP color bit, sh\u0027s skipped __flush_purge_region), the user reads stale lines and recovers the prior contents of that physical memory \u2014 potentially hundreds of megabytes to gigabytes of another process\u0027s or KVM guest\u0027s freed hugetlb data. The fix commit explicitly cites \"information leak\".\nI:H - The fix commit explicitly states the unaligned address \"may cause memory corruption\": dirty stale aliased cache lines can be written back over the region the kernel just zeroed, silently corrupting memory in a page the kernel guarantees is zero-filled, including shared hugetlbfs pages consumed by other processes.\nA:H - Silent corruption of hugetlbfs-backed memory that callers assume is zeroed \u2014 typically KVM guest RAM or a database\u0027s shared segment on these gigantic-page deployments \u2014 reliably produces crashes and hangs in the affected workloads, and the higher value is taken given the fix commit\u0027s own \"memory corruption\" characterization."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:43:16.556Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b79b6fe0737f233f0be1465052b7f0e75f324735"
        },
        {
          "url": "https://git.kernel.org/stable/c/8aca2bc96c833ba695ede7a45ad7784c836a262e"
        }
      ],
      "title": "mm: use aligned address in clear_gigantic_page()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-52319",
    "datePublished": "2025-01-11T12:35:39.280Z",
    "dateReserved": "2025-01-11T12:33:33.694Z",
    "dateUpdated": "2026-08-05T11:43:16.556Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-52319",
      "date": "2026-08-05",
      "epss": "0.00209",
      "percentile": "0.11192"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: use aligned address in clear_gigantic_page()\\n\\nIn current kernel, hugetlb_no_page() calls folio_zero_user() with the\\nfault address.  Where the fault address may be not aligned with the huge\\npage size.  Then, folio_zero_user() may call clear_gigantic_page() with\\nthe address, while clear_gigantic_page() requires the address to be huge\\npage size aligned.  So, this may cause memory corruption or information\\nleak, addtional, use more obvious naming \u0027addr_hint\u0027 instead of \u0027addr\u0027 for\\nclear_gigantic_page().\"}]",
      "id": "CVE-2024-52319",
      "lastModified": "2025-01-11T13:15:24.843",
      "published": "2025-01-11T13:15:24.843",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/8aca2bc96c833ba695ede7a45ad7784c836a262e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/b79b6fe0737f233f0be1465052b7f0e75f324735\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Received"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-52319\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-11T13:15:24.843\",\"lastModified\":\"2026-08-04T11:21:44.887\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: use aligned address in clear_gigantic_page()\\n\\nIn current kernel, hugetlb_no_page() calls folio_zero_user() with the\\nfault address.  Where the fault address may be not aligned with the huge\\npage size.  Then, folio_zero_user() may call clear_gigantic_page() with\\nthe address, while clear_gigantic_page() requires the address to be huge\\npage size aligned.  So, this may cause memory corruption or information\\nleak, addtional, use more obvious naming \u0027addr_hint\u0027 instead of \u0027addr\u0027 for\\nclear_gigantic_page().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: usar direcci\u00f3n alineada en clear_gigantic_page() En el kernel actual, hugetlb_no_page() llama a folio_zero_user() con la direcci\u00f3n de error. Donde la direcci\u00f3n de error puede no estar alineada con el tama\u00f1o de p\u00e1gina enorme. Entonces, folio_zero_user() puede llamar a clear_gigantic_page() con la direcci\u00f3n, mientras que clear_gigantic_page() requiere que la direcci\u00f3n est\u00e9 alineada con el tama\u00f1o de p\u00e1gina enorme. Por lo tanto, esto puede causar corrupci\u00f3n de memoria o fuga de informaci\u00f3n. Adem\u00e1s, use un nombre m\u00e1s obvio \u0027addr_hint\u0027 en lugar de \u0027addr\u0027 para clear_gigantic_page().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/hugetlbfs/inode.c\",\"mm/memory.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"78fefd04c123493bbf28434768fa577b2153c79b\",\"lessThan\":\"b79b6fe0737f233f0be1465052b7f0e75f324735\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"78fefd04c123493bbf28434768fa577b2153c79b\",\"lessThan\":\"8aca2bc96c833ba695ede7a45ad7784c836a262e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/hugetlbfs/inode.c\",\"mm/memory.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.7\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.12.7\",\"matchCriteriaId\":\"6ACCAC21-7ECC-4FBC-A3F6-FD71065601D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/8aca2bc96c833ba695ede7a45ad7784c836a262e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b79b6fe0737f233f0be1465052b7f0e75f324735\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T03:52:49+00:00",
      "cve": "CVE-2024-52319",
      "id": "CVE-2024-52319",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm: use aligned address in clear_gigantic_page()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-52319.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T16:53:06Z",
      "cve": "CVE-2024-52319",
      "id": "CVE-2024-52319",
      "initial_release_date": "2025-01-12T00:16:06Z",
      "product_status:known_not_affected": "346",
      "product_status:recommended": "53",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-52319",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-52319.json",
      "version": "21"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.