CVE-2024-50112

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
05/11/2024
Last modified:
01/10/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> x86/lam: Disable ADDRESS_MASKING in most cases<br /> <br /> Linear Address Masking (LAM) has a weakness related to transient<br /> execution as described in the SLAM paper[1]. Unless Linear Address<br /> Space Separation (LASS) is enabled this weakness may be exploitable.<br /> <br /> Until kernel adds support for LASS[2], only allow LAM for COMPILE_TEST,<br /> or when speculation mitigations have been disabled at compile time,<br /> otherwise keep LAM disabled.<br /> <br /> There are no processors in market that support LAM yet, so currently<br /> nobody is affected by this issue.<br /> <br /> [1] SLAM: https://download.vusec.net/papers/slam_sp24.pdf<br /> [2] LASS: https://lore.kernel.org/lkml/20230609183632.48706-1-alexander.shishkin@linux.intel.com/<br /> <br /> [ dhansen: update SPECULATION_MITIGATIONS -&gt; CPU_MITIGATIONS ]

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.6.59 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.11.6 (excluding)
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*