CVE-2024-49975

MEDIUM

Linux kernel - Info Disclosure

Title source: llm

Description

In the Linux kernel, the following vulnerability has been resolved: uprobes: fix kernel info leak via "[uprobes]" vma xol_add_vma() maps the uninitialized page allocated by __create_xol_area() into userspace. On some architectures (x86) this memory is readable even without VM_READ, VM_EXEC results in the same pgprot_t as VM_EXEC|VM_READ, although this doesn't really matter, debugger can read this memory anyway.

References (11)

[Mailing List] https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

[Mailing List] https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html

[Patch] https://git.kernel.org/stable/c/f31f92107e5a8ecc8902705122c594e979a351fe

[Patch] https://git.kernel.org/stable/c/fe5e9182d3e227476642ae2b312e2356c4d326a3

[Patch] https://git.kernel.org/stable/c/21cb47db1ec9765f91304763a24565ddc22d2492

[Patch] https://git.kernel.org/stable/c/24141df5a8615790950deedd926a44ddf1dfd6d8

[Patch] https://git.kernel.org/stable/c/2aa45f43709ba2082917bd2973d02687075b6eee

[Patch] https://git.kernel.org/stable/c/34820304cc2cd1804ee1f8f3504ec77813d29c8e

[Patch] https://git.kernel.org/stable/c/5b981d8335e18aef7908a068529a3287258ff6d8

[Patch] https://git.kernel.org/stable/c/9634e8dc964a4adafa7e1535147abd7ec29441a6

[Patch] https://git.kernel.org/stable/c/f561b48d633ac2e7d0d667020fc634a96ade33a0

Scores

CVSS v3 5.5

EPSS 0.0001

EPSS Percentile 0.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Classification

CWE

CWE-401

Status published

Affected Products (10)

linux/linux_kernel < 5.10.227

linux/linux_kernel

linux/Kernel < 4.19.323linux

linux/Kernel < 5.4.285linux

linux/Kernel < 5.10.227linux

linux/Kernel < 5.15.168linux

linux/Kernel < 6.1.113linux

linux/Kernel < 6.6.55linux

linux/Kernel < 6.10.14linux

linux/Kernel < 6.11.3linux

Timeline

Published Oct 21, 2024

Tracked Since Feb 18, 2026