CVE-2024-53241

MediumCVSS 5.5/10Last modified Nov 5, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

x86/xen: don't do PV iret hypercall through hypercall page

Instead of jumping to the Xen hypercall page for doing the iret hypercall, directly code the required sequence in xen-asm.S.

This is done in preparation of no longer using hypercall page at all, as it has shown to cause problems with speculation mitigations.

This is part of XSA-466 / CVE-2024-53241.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

VendorProductVersions
LinuxLinux>= cdacc1278b12d929f9a053c245ff3d16eb7af9f8, < 05df6e6cd9a76b778aee33c3c18c9f3b3566d4a5; >= cdacc1278b12d929f9a053c245ff3d16eb7af9f8, < c7b4cfa6213a44fa48714186dfdf125072d036e3; >= cdacc1278b12d929f9a053c245ff3d16eb7af9f8, < fa719857f613fed94a79da055b13ca51214c694f; >= cdacc1278b12d929f9a053c245ff3d16eb7af9f8, < 82c211ead1ec440dbf81727e17b03b5e3c44b93d; >= cdacc1278b12d929f9a053c245ff3d16eb7af9f8, < f7c3fdad0a474062d566aae3289d490d7e702d30; >= cdacc1278b12d929f9a053c245ff3d16eb7af9f8, < a2796dff62d6c6bfc5fbebdf2bee0d5ac0438906
LinuxLinux2.6.27

References

Timeline

Published
Dec 24, 2024
Last modified
Nov 5, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-532427.8A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versiCVE-2024-532434.3In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and versions below 3.2.462, 3.7.18, and 3.8.5 of the Splunk Secure Gateway app oCVE-2024-532445.7In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.2.2406.107, 9.2.2403.109, and 9.1.231CVE-2024-532454.3In Splunk Enterprise versions below 9.3.0, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.1.2312.206, a low-privileged user thaCVE-2024-532467.5In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.3.2408.101, 9.2.2406.106, 9.2.2403.11CVE-2024-532478.8In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7, and versions below 3.4.261 and 3.7.13 of the Splunk Secure Gateway app on SplunCVE-2024-53256.5The Form Vibes plugin for WordPress is vulnerable to SQL Injection via the ‘fv_export_data’ parameter in all versions up to, and including, CVE-2024-532535.3Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario wherCVE-2024-532555.4BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In CVE-2024-532567.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. `rizin.c` still had an old snippet of code which suffered a comCVE-2024-532574.9Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet doCVE-2024-532585.3Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can d