CVE-2024-0564: linux-libc-dev - Kernel Samepage Merging (KSM) Memory Deduplication Side Channel
Summary
CVE-2024-0564: A flaw was found in the Linux kernel's memory deduplication mechanism. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling C programs that use the Linux kernel interfaces. It is an essential component for building and linking applications on Linux systems. The vulnerability affects version 6.1.90-1 of the linux-libc-dev package.
Vulnerability Detail
A flaw has been discovered in the Linux kernel's memory deduplication mechanism, specifically in the Kernel Samepage Merging (KSM) feature. The issue arises when the attacker and the victim share the same host and the KSM's default setting of "max page sharing" is set to 256. In this scenario, the attacker can time the unmap operation to coincide with the victim's page, potentially leading to memory leakage. The severity of this vulnerability is rated as MEDIUM.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability at the moment. It is advised to apply the official patch or update the package to the fixed version as soon as possible.
Conclusion
In conclusion, the linux-libc-dev package is vulnerable to a memory deduplication side channel issue in the Kernel Samepage Merging (KSM) feature. This vulnerability can potentially lead to memory leakage and information disclosure. Users are advised to update their systems to the latest version of the linux-libc-dev package or apply the provided patches. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a development package that provides header files and libraries for compiling C programs that use Linux kernel interfaces.
Kernel Samepage Merging (KSM) is a feature in the Linux kernel that allows for memory deduplication, reducing memory usage by merging identical memory pages.
This vulnerability affects systems where the attacker and the victim share the same host and the KSM's "max page sharing" setting is at the default value of 256. It can potentially lead to memory leakage and information disclosure.
The severity of this vulnerability is rated as MEDIUM.
To fix this vulnerability, it is recommended to update the linux-libc-dev package to the latest version that includes the necessary patches.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
