CVE-2024-0564 — Observable Discrepancy in Linux Kernel

Vendor	Product	Version range	Fixed in
debian	linux	—	—
linux	linux_kernel	4.4.0-96.119 – 5.15.0-58	—
redhat	enterprise_linux	—	—
redhat	enterprise_linux	—	—

GHSA

GHSA-5m9g-m2vj-47r4: A flaw was found in the Linux kernel's memory deduplication mechanism

ghsa_unreviewed·2024-01-30

CVE-2024-0564 [MEDIUM] CWE-203 GHSA-5m9g-m2vj-47r4: A flaw was found in the Linux kernel's memory deduplication mechanism A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version 4.4.0-96.119, can create a side channel. When the attacker and the victim share the same host and the default setting of KSM is "max page sharing=256", it is possible for the attacker to time the unmap to merge with the victim's page. The unmapping time depends on whether it merges with the victim's page and additional physical pages are created beyond the KSM's "max page share". Through these operations, the attacker can leak the victim's page.

OSV

CVE-2024-0564: A flaw was found in the Linux kernel's memory deduplication mechanism

osv·2024-01-30·CVSS 6.5

CVE-2024-0564 [MEDIUM] CVE-2024-0564: A flaw was found in the Linux kernel's memory deduplication mechanism A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version 4.4.0-96.119, can create a side channel. When the attacker and the victim share the same host and the default setting of KSM is "max page sharing=256", it is possible for the attacker to time the unmap to merge with the victim's page. The unmapping time depends on whether it merges with the victim's page and additional physical pages are created beyond the KSM's "max page share". Through these operations, the attacker can leak the victim's page.

Red Hat

kernel: max page sharing of Kernel Samepage Merging (KSM) may cause memory deduplication

vendor_redhat·2024-01-20·CVSS 5.3

CVE-2024-0564 [MEDIUM] CWE-203 kernel: max page sharing of Kernel Samepage Merging (KSM) may cause memory deduplication kernel: max page sharing of Kernel Samepage Merging (KSM) may cause memory deduplication A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version 4.4.0-96.119, can create a side channel. When the attacker and the victim share the same host and the default setting of KSM is "max page sharing=256", it is possible for the attacker to time the unmap to merge with the victim's page. The unmapping time depends on whether it merges with the victim's page and additional physical pages are created beyond the KSM's "max page share". Through these operations, the attacker can leak the victim's page. A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel S

Debian

CVE-2024-0564: linux - A flaw was found in the Linux kernel's memory deduplication mechanism. The max p...

vendor_debian·2024·CVSS 5.3

CVE-2024-0564 [MEDIUM] CVE-2024-0564: linux - A flaw was found in the Linux kernel's memory deduplication mechanism. The max p... A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version 4.4.0-96.119, can create a side channel. When the attacker and the victim share the same host and the default setting of KSM is "max page sharing=256", it is possible for the attacker to time the unmap to merge with the victim's page. The unmapping time depends on whether it merges with the victim's page and additional physical pages are created beyond the KSM's "max page share". Through these operations, the attacker can leak the victim's page. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2024-0564: A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version…

Affected

CVSS provenance