Log in Start free

Vulnerability · Published Nov 5, 2024 · Assigned by Linux

CVE-2024-50112x86/lam: Disable ADDRESS_MASKING in most cases

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 79.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: x86/lam: Disable ADDRESS_MASKING in most cases Linear Address Masking (LAM) has a weakness related to transient execution as described in the SLAM paper[1]. Unless Linear Address Space Separation (LASS) is enabled this weakness may be exploitable. Until kernel adds support for LASS[2], only allow LAM for COMPILE_TEST, or when speculation mitigations have been disabled at compile time, otherwise keep LAM disabled. There are no processors in market that support LAM yet, so currently nobody is affected by this issue. [1] SLAM: https://download.vusec.net/papers/slam_sp24.pdf [2] LASS: https://lore.kernel.org/lkml/20230609183632.48706-1-alexander.shishkin@linux.intel.com/ [ dhansen: update SPECULATION_MITIGATIONS -> CPU_MITIGATIONS ]

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.11.6-1DEBIAN-CVE-2024-50112
Debian:14linux6.11.6-1DEBIAN-CVE-2024-50112
Ubuntu:24.04:LTSlinux6.8.0-58.60UBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux6.8.0-58.60USN-7449-1
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-aws6.8.0-1027.29USN-7449-1
Ubuntu:24.04:LTSlinux-aws6.8.0-1027.29UBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1027.29~22.04.1UBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-azure6.8.0-1027.32UBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-azure6.8.0-1027.32USN-7449-1
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-azure-6.116.11.0-1012.12~24.04.1UBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1027.32~22.04.1UBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1027.32~22.04.1USN-7449-1
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-azure-nvidia6.8.0-1014.15UBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-gcp6.8.0-1028.30UBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-gcp6.8.0-1028.30USN-7450-1
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-gcp-6.116.11.0-1011.11~24.04.1UBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1028.30~22.04.1UBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1028.30~22.04.1USN-7452-1
Ubuntu:24.04:LTSlinux-gke6.8.0-1023.27USN-7450-1
Ubuntu:24.04:LTSlinux-gke6.8.0-1023.27UBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1010.12USN-7450-1
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1010.12UBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-58.60~22.04.1USN-7449-2
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-58.60~22.04.1UBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-ibm6.8.0-1024.24UBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-ibm6.8.0-1024.24USN-7449-1
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1024.24~22.04.1UBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-58.60.1USN-7449-1
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-58.60.1UBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-58.60.1~22.04.1UBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-58.60.1~22.04.1USN-7449-1
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1026.29USN-7449-1
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1026.29UBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-nvidia-6.116.11.0-1007.7UBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1026.29~22.04.1UBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1026.29~22.04.1USN-7449-1
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1026.29.1USN-7449-1
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1026.29.1UBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1008.8UBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-oem-6.116.11.0-1015.15UBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1026.26UBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1026.26USN-7449-1
Ubuntu:24.04:LTSlinux-oracle6.8.0-1024.25USN-7449-1
Ubuntu:24.04:LTSlinux-oracle6.8.0-1024.25UBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1024.25~22.04.1USN-7449-1
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1024.25~22.04.1UBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-raspi6.8.0-1028.32UBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-riscv6.8.0-58.60.1UBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-58.60.1~22.04.1UBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-50112
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-50112
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1017.18UBUNTU-CVE-2024-50112

Affected products (as reported)

VendorProductVersions
Linux Linux 6449dcb0cac738219d13c618af7fd8664735f99d – before 60a5ba560f296ad8da153f6ad3f70030bfa3958f6449dcb0cac738219d13c618af7fd8664735f99d – before 690599066488d16db96ac0d6340f9372fc56f3376449dcb0cac738219d13c618af7fd8664735f99d – before 3267cb6d3a174ff83d6287dcd5b0047bbd912452
Linux Linux 6.4

References