CVE-2024-50112
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
05/11/2024
Last modified:
01/10/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
x86/lam: Disable ADDRESS_MASKING in most cases<br />
<br />
Linear Address Masking (LAM) has a weakness related to transient<br />
execution as described in the SLAM paper[1]. Unless Linear Address<br />
Space Separation (LASS) is enabled this weakness may be exploitable.<br />
<br />
Until kernel adds support for LASS[2], only allow LAM for COMPILE_TEST,<br />
or when speculation mitigations have been disabled at compile time,<br />
otherwise keep LAM disabled.<br />
<br />
There are no processors in market that support LAM yet, so currently<br />
nobody is affected by this issue.<br />
<br />
[1] SLAM: https://download.vusec.net/papers/slam_sp24.pdf<br />
[2] LASS: https://lore.kernel.org/lkml/20230609183632.48706-1-alexander.shishkin@linux.intel.com/<br />
<br />
[ dhansen: update SPECULATION_MITIGATIONS -> CPU_MITIGATIONS ]
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.6.59 (excluding) | |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.11.6 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



