CVE-2024-0564

Severity CVSS v4.0:

Pending analysis

Type:

Unavailable / Other

Publication date:

30/01/2024

Last modified:

25/11/2024

Description

A flaw was found in the Linux kernel&#39;s memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version 4.4.0-96.119, can create a side channel. When the attacker and the victim share the same host and the default setting of KSM is "max page sharing=256", it is possible for the attacker to time the unmap to merge with the victim&#39;s page. The unmapping time depends on whether it merges with the victim&#39;s page and additional physical pages are created beyond the KSM&#39;s "max page share". Through these operations, the attacker can leak the victim&#39;s page.

Impact

Vector 3.x

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS v3.1 Severity and Metrics:

Base Score: 5.30 MEDIUM
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector (AV): Adjacent
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): None
Availability (A): None

Base Score 3.x

5.30

Severity 3.x

MEDIUM

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:o:linux:linux_kernel::::::::	4.4.0-96.119 (including)	5.15.0-58 (including)
cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*

To consult the complete list of CPE names with products and versions, see this page

CVE-2024-0564

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools