CVE-2024-2201

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
Xen	Xen	See advisory "x86: Native Branch History Injection"

References

Timeline

Published: Dec 19, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-220105.5In dvfs_plugin_caller of fvp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information d CVE-2024-220117.5In ss_ProcessRejectComponent of ss_MmConManagement.c, there is a possible out of bounds read due to a missing bounds check. This could lead CVE-2024-220127.8there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional e CVE-2024-220135.3U-Boot environment is read from unauthenticated partition.CVE-2024-220148.8An issue discovered in 360 Total Security Antivirus through 11.0.0.1061 for Windows allows attackers to gain escalated privileges via Symbol CVE-2024-220156.5Improper input validation for some Intel(R) DLB driver software before version 8.5.0 may allow an authenticated user to potentially denial o CVE-2024-220167.8In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an authorized user can write directly to the Scada directory. This may CVE-2024-220177.3setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform CVE-2024-220182.9A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. CVE-2024-220197.5A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resour CVE-2024-22025.4The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the legacy Image widget in all versions CVE-2024-220206.5A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can e