CVE-2024-51729 (GCVE-0-2024-51729)

Vulnerability from cvelistv5 – Published: 2025-01-11 12:35 – Updated: 2026-08-05 11:43
VLAI
Title
mm: use aligned address in copy_user_gigantic_page()
Summary
In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in copy_user_gigantic_page() In current kernel, hugetlb_wp() calls copy_user_large_folio() with the fault address. Where the fault address may be not aligned with the huge page size. Then, copy_user_large_folio() may call copy_user_gigantic_page() with the address, while copy_user_gigantic_page() requires the address to be huge page size aligned. So, this may cause memory corruption or information leak, addtional, use more obvious naming 'addr_hint' instead of 'addr' for copy_user_gigantic_page().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 530dd9926dc16220d2fae0997f45cda94f5f0864 , < cb12d61361ce769672c7c7bd32107252598cdd8b (git)
Affected: 530dd9926dc16220d2fae0997f45cda94f5f0864 , < f5d09de9f1bf9674c6418ff10d0a40cfe29268e1 (git)
Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.7 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/hugetlb.c",
            "mm/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cb12d61361ce769672c7c7bd32107252598cdd8b",
              "status": "affected",
              "version": "530dd9926dc16220d2fae0997f45cda94f5f0864",
              "versionType": "git"
            },
            {
              "lessThan": "f5d09de9f1bf9674c6418ff10d0a40cfe29268e1",
              "status": "affected",
              "version": "530dd9926dc16220d2fae0997f45cda94f5f0864",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/hugetlb.c",
            "mm/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.7",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: use aligned address in copy_user_gigantic_page()\n\nIn current kernel, hugetlb_wp() calls copy_user_large_folio() with the\nfault address.  Where the fault address may be not aligned with the huge\npage size.  Then, copy_user_large_folio() may call\ncopy_user_gigantic_page() with the address, while\ncopy_user_gigantic_page() requires the address to be huge page size\naligned.  So, this may cause memory corruption or information leak,\naddtional, use more obvious naming \u0027addr_hint\u0027 instead of \u0027addr\u0027 for\ncopy_user_gigantic_page()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through a local page fault on a hugetlb mapping created by the calling process (mmap MAP_HUGETLB / hugetlbfs MAP_PRIVATE), with no network or remote component. Exploitation requires the attacker to execute code on the target system.\nAC:L - The attacker fully and deterministically controls the faulting address handed to hugetlb_wp() \u2014 simply writing to any non-huge-page-aligned offset in a private gigantic hugetlb mapping guarantees the misaligned vaddr, with no race, no timing window, and no dependence on memory layout. Gigantic hugetlb pools are a widely deployed, routinely provisioned configuration (databases, DPDK, KVM hosts).\nPR:L - Any unprivileged local user can reach the path \u2014 mmap(MAP_PRIVATE|MAP_ANONYMOUS|MAP_HUGETLB|MAP_HUGE_1GB) uses HUGETLB_ANON_FILE, which bypasses the can_do_hugetlb_shm() capability gate that only guards SHM_HUGETLB, and an open hugetlbfs file mapped MAP_PRIVATE works equally well. No CAP_IPC_LOCK, CAP_SYS_ADMIN, or root is needed.\nUI:N - The attacker triggers the COW fault entirely within its own process by writing to its own mapping; no victim action, no file to open, no filesystem to mount.\nS:U - The corruption and disclosure occur in memory managed by the same kernel security authority; no VM escape, IOMMU, or sandbox boundary is crossed by the flaw itself.\nC:H - The commit states the misalignment \"may cause memory corruption or information leak\" \u2014 on cache-aliasing architectures the wrong vaddr selects the wrong cache color in kmap_coherent()/the flush decision, so the newly allocated gigantic folio can expose residual contents of a previously-freed 1GB-scale page (another process\u0027s or a KVM guest\u0027s data) directly to the attacker\u0027s userspace mapping.\nI:H - The copy is performed through an incorrectly colored/flushed mapping across every subpage of the gigantic folio, so attacker-reachable data is silently written to or left in the wrong cache alias, corrupting up to a gigabyte of page contents including memory backing KVM guests.\nA:H - Silent corruption of an entire gigantic folio\u0027s contents \u2014 code, stack, page-table-adjacent guest RAM, or application data \u2014 leads to unpredictable faults and crashes, and can be triggered repeatedly by an unprivileged user for as long as gigantic pages remain in the pool."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:43:15.492Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cb12d61361ce769672c7c7bd32107252598cdd8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5d09de9f1bf9674c6418ff10d0a40cfe29268e1"
        }
      ],
      "title": "mm: use aligned address in copy_user_gigantic_page()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-51729",
    "datePublished": "2025-01-11T12:35:38.375Z",
    "dateReserved": "2025-01-11T12:33:33.687Z",
    "dateUpdated": "2026-08-05T11:43:15.492Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-51729",
      "date": "2026-08-05",
      "epss": "0.00209",
      "percentile": "0.11192"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: use aligned address in copy_user_gigantic_page()\\n\\nIn current kernel, hugetlb_wp() calls copy_user_large_folio() with the\\nfault address.  Where the fault address may be not aligned with the huge\\npage size.  Then, copy_user_large_folio() may call\\ncopy_user_gigantic_page() with the address, while\\ncopy_user_gigantic_page() requires the address to be huge page size\\naligned.  So, this may cause memory corruption or information leak,\\naddtional, use more obvious naming \u0027addr_hint\u0027 instead of \u0027addr\u0027 for\\ncopy_user_gigantic_page().\"}]",
      "id": "CVE-2024-51729",
      "lastModified": "2025-01-11T13:15:24.650",
      "published": "2025-01-11T13:15:24.650",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/cb12d61361ce769672c7c7bd32107252598cdd8b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f5d09de9f1bf9674c6418ff10d0a40cfe29268e1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Received"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-51729\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-11T13:15:24.650\",\"lastModified\":\"2026-08-04T11:21:44.770\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: use aligned address in copy_user_gigantic_page()\\n\\nIn current kernel, hugetlb_wp() calls copy_user_large_folio() with the\\nfault address.  Where the fault address may be not aligned with the huge\\npage size.  Then, copy_user_large_folio() may call\\ncopy_user_gigantic_page() with the address, while\\ncopy_user_gigantic_page() requires the address to be huge page size\\naligned.  So, this may cause memory corruption or information leak,\\naddtional, use more obvious naming \u0027addr_hint\u0027 instead of \u0027addr\u0027 for\\ncopy_user_gigantic_page().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: usar direcci\u00f3n alineada en copy_user_gigantic_page() En el kernel actual, hugetlb_wp() llama a copy_user_large_folio() con la direcci\u00f3n de error. Donde la direcci\u00f3n de error puede no estar alineada con el tama\u00f1o de p\u00e1gina enorme. Entonces, copy_user_large_folio() puede llamar a copy_user_gigantic_page() con la direcci\u00f3n, mientras que copy_user_gigantic_page() requiere que la direcci\u00f3n est\u00e9 alineada con el tama\u00f1o de p\u00e1gina enorme. Por lo tanto, esto puede causar corrupci\u00f3n de memoria o fuga de informaci\u00f3n. Adem\u00e1s, use un nombre m\u00e1s obvio \u0027addr_hint\u0027 en lugar de \u0027addr\u0027 para copy_user_gigantic_page().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/hugetlb.c\",\"mm/memory.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"530dd9926dc16220d2fae0997f45cda94f5f0864\",\"lessThan\":\"cb12d61361ce769672c7c7bd32107252598cdd8b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"530dd9926dc16220d2fae0997f45cda94f5f0864\",\"lessThan\":\"f5d09de9f1bf9674c6418ff10d0a40cfe29268e1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/hugetlb.c\",\"mm/memory.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.7\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.12.7\",\"matchCriteriaId\":\"6ACCAC21-7ECC-4FBC-A3F6-FD71065601D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/cb12d61361ce769672c7c7bd32107252598cdd8b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f5d09de9f1bf9674c6418ff10d0a40cfe29268e1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:13:18+00:00",
      "cve": "CVE-2024-51729",
      "id": "CVE-2024-51729",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm: use aligned address in copy_user_gigantic_page()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-51729.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:50:30Z",
      "cve": "CVE-2024-51729",
      "id": "CVE-2024-51729",
      "initial_release_date": "2025-01-12T00:16:11Z",
      "product_status:known_not_affected": "346",
      "product_status:recommended": "53",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-51729",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-51729.json",
      "version": "21"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.