CVE-2024-49975

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

uprobes: fix kernel info leak via "[uprobes]" vma

xol_add_vma() maps the uninitialized page allocated by __create_xol_area() into userspace. On some architectures (x86) this memory is readable even without VM_READ, VM_EXEC results in the same pgprot_t as VM_EXEC|VM_READ, although this doesn't really matter, debugger can read this memory anyway.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

VendorProductVersions
LinuxLinux>= d4b3b6384f98f8692ad0209891ccdbc7e78bbefe, < f31f92107e5a8ecc8902705122c594e979a351fe; >= d4b3b6384f98f8692ad0209891ccdbc7e78bbefe, < fe5e9182d3e227476642ae2b312e2356c4d326a3; >= d4b3b6384f98f8692ad0209891ccdbc7e78bbefe, < f561b48d633ac2e7d0d667020fc634a96ade33a0; >= d4b3b6384f98f8692ad0209891ccdbc7e78bbefe, < 21cb47db1ec9765f91304763a24565ddc22d2492; >= d4b3b6384f98f8692ad0209891ccdbc7e78bbefe, < 24141df5a8615790950deedd926a44ddf1dfd6d8; >= d4b3b6384f98f8692ad0209891ccdbc7e78bbefe, < 5b981d8335e18aef7908a068529a3287258ff6d8; >= d4b3b6384f98f8692ad0209891ccdbc7e78bbefe, < 2aa45f43709ba2082917bd2973d02687075b6eee; >= d4b3b6384f98f8692ad0209891ccdbc7e78bbefe, < 9634e8dc964a4adafa7e1535147abd7ec29441a6; >= d4b3b6384f98f8692ad0209891ccdbc7e78bbefe, < 34820304cc2cd1804ee1f8f3504ec77813d29c8e
LinuxLinux3.5

References

Timeline

Published
Oct 21, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-499765.5In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Drop interface_lock in stop_kthread() stop_kthread()CVE-2024-499775.5In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Fix zero-division error when disabling tc cbs The commit CVE-2024-499785.5In the Linux kernel, the following vulnerability has been resolved: gso: fix udp gso fraglist segmentation after pull from frag_list DetecCVE-2024-499795.5In the Linux kernel, the following vulnerability has been resolved: net: gso: fix tcp fraglist segmentation after pull from frag_list DeteCVE-2024-499805.5In the Linux kernel, the following vulnerability has been resolved: vrf: revert "vrf: Remove unnecessary RCU-bh critical section" This revCVE-2024-499817.0In the Linux kernel, the following vulnerability has been resolved: media: venus: fix use after free bug in venus_remove due to race conditCVE-2024-499827.8In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in more places For fixinCVE-2024-499837.8In the Linux kernel, the following vulnerability has been resolved: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free CVE-2024-499847.8In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Prevent out of bounds access in performance query extensions CVE-2024-499855.5In the Linux kernel, the following vulnerability has been resolved: i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resCVE-2024-499867.8In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: Fix use after free on platform_devicCVE-2024-499875.5In the Linux kernel, the following vulnerability has been resolved: bpftool: Fix undefined behavior in qsort(NULL, 0, ...) When netfilter
CVE-2024-49975: Medium severity, CVSS 5.5 | Vulnix