Critical Vulnerability in Linux Kernel: Address Masking Weakness
Summary
DEBIAN-CVE-2024-50112: In the Linux kernel, the following vulnerability has been resolved: x86/lam: Disable ADDRESS_MASKING in most cases Linear Address Masking (LAM) has a weakness related to transient execution as described in the SLAM paper... Affects linux versions < 6.11.6-1. Fixed in 6.11.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware resources and providing essential services for software applications. It is known for its robustness and flexibility, supporting a wide range of hardware architectures. However, it is also susceptible to vulnerabilities that can compromise system security. This specific vulnerability relates to Linear Address Masking (LAM), which, under certain conditions, may expose systems to transient execution attacks.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified concerning Linear Address Masking (LAM). This weakness is linked to transient execution, as detailed in the SLAM paper. If Linear Address Space Separation (LASS) is not enabled, this vulnerability could potentially be exploited. Currently, no processors on the market support LAM, meaning that, as of now, no systems are directly affected by this issue. The vulnerability arises from the kernel's handling of LAM, which should only be allowed for COMPILE_TEST or when speculation mitigations are disabled at compile time.
How To Fix
Minimum fixed version
6.11.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability since it is not exploitable on existing hardware. However, users can disable LAM in their kernel configuration until support for LASS is added.
Conclusion
The identified vulnerability in the Linux kernel concerning Linear Address Masking presents a potential risk, although it is not currently exploitable due to the lack of supporting hardware. Users are advised to update their systems to the latest kernel version to ensure protection against this and future vulnerabilities.
See every vulnerability recorded for linux →
FAQ
LAM is a feature in the Linux kernel that aims to enhance security by masking linear addresses. However, it has been found to have weaknesses that could be exploited under certain conditions.
As of now, no processors support LAM, so there is no immediate risk to systems. However, it is essential to stay updated with kernel patches to avoid potential future risks.
You should update your Linux kernel to version 6.11.6-1 or later to ensure that the vulnerability is patched.
Detailed information can be found in the SLAM paper and the kernel mailing list discussions regarding LASS.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software without requiring access to the code or installation. You can check your application using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
