CVE-2024-51729

HighCVSS 7.8/10Last modified Aug 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mm: use aligned address in copy_user_gigantic_page()

In current kernel, hugetlb_wp() calls copy_user_large_folio() with the fault address. Where the fault address may be not aligned with the huge page size. Then, copy_user_large_folio() may call copy_user_gigantic_page() with the address, while copy_user_gigantic_page() requires the address to be huge page size aligned. So, this may cause memory corruption or information leak, addtional, use more obvious naming 'addr_hint' instead of 'addr' for copy_user_gigantic_page().

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Jan 11, 2025
Last modified
Aug 4, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-51735.4The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video player widget seCVE-2024-517348.7Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data mainCVE-2024-517358.7Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting (XSS) occurs on the Osmedues web server when viewing results fromCVE-2024-517369.8Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file naCVE-2024-517377.0RediSearch is a Redis module that provides querying, secondary indexing, and full-text search for Redis. An authenticated redis user executiCVE-2024-517388.1Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validatCVE-2024-517395.3Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easierCVE-2024-51745.3A flaw in Gliffy results in broken authentication through the reset functionality of the application.CVE-2024-517408.8Combodo iTop is a simple, web based IT Service Management tool. This vulnerability can be used to create HTTP requests on behalf of the servCVE-2024-517414.4Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL seCVE-2024-517438.8MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulneCVE-2024-517443.1golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation
CVE-2024-51729: High severity, CVSS 7.8 | Vulnix