CVE-2024-53241
published 2024-12-24CVE-2024-53241: In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV iret hypercall through hypercall page Instead of jumping to the Xen…
PriorityP423medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.31%
23.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
x86/xen: don't do PV iret hypercall through hypercall page
Instead of jumping to the Xen hypercall page for doing the iret
hypercall, directly code the required sequence in xen-asm.S.
This is done in preparation of no longer using hypercall page at all,
as it has shown to cause problems with speculation mitigations.
This is part of XSA-466 / CVE-2024-53241.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.123-1 (bookworm) | linux 6.1.123-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.123-1 (bookworm) | linux 6.1.123-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= cdacc1278b12d929f9a053c245ff3d16eb7af9f8 < 05df6e6cd9a76b778aee33c3c18c9f3b3566d4a5 | 05df6e6cd9a76b778aee33c3c18c9f3b3566d4a5 |
| linux | linux | >= cdacc1278b12d929f9a053c245ff3d16eb7af9f8 < c7b4cfa6213a44fa48714186dfdf125072d036e3 | c7b4cfa6213a44fa48714186dfdf125072d036e3 |
| linux | linux | >= cdacc1278b12d929f9a053c245ff3d16eb7af9f8 < fa719857f613fed94a79da055b13ca51214c694f | fa719857f613fed94a79da055b13ca51214c694f |
| linux | linux | >= cdacc1278b12d929f9a053c245ff3d16eb7af9f8 < 82c211ead1ec440dbf81727e17b03b5e3c44b93d | 82c211ead1ec440dbf81727e17b03b5e3c44b93d |
| linux | linux | >= cdacc1278b12d929f9a053c245ff3d16eb7af9f8 < f7c3fdad0a474062d566aae3289d490d7e702d30 | f7c3fdad0a474062d566aae3289d490d7e702d30 |
| linux | linux | >= cdacc1278b12d929f9a053c245ff3d16eb7af9f8 < a2796dff62d6c6bfc5fbebdf2bee0d5ac0438906 | a2796dff62d6c6bfc5fbebdf2bee0d5ac0438906 |
| linux | linux_kernel | < 5.10.232 | 5.10.232 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.234-1 | 5.10.234-1 |
| linux | linux_kernel | >= 0 < 6.1.123-1 | 6.1.123-1 |
| linux | linux_kernel | >= 0 < 6.12.6-1 | 6.12.6-1 |
| linux | linux_kernel | >= 0 < 6.12.6-1 | 6.12.6-1 |
| linux | linux_kernel | >= 5.11 < 5.15.175 | 5.15.175 |
| linux | linux_kernel | >= 5.16 < 6.1.121 | 6.1.121 |
| linux | linux_kernel | >= 6.2 < 6.6.67 | 6.6.67 |
| linux | linux_kernel | >= 6.7 < 6.12.6 | 6.12.6 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens Third-Party Components in SINEC OS
cisa_ics·2025-08-14
Siemens Third-Party Components in SINEC OS
ICS Advisory
##
Siemens Third-Party Components in SINEC OS
Release DateAugust 14, 2025
Alert CodeICSA-25-226-07
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.1
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: Third-Party Components in SINEC OS
- Vulnerabilities: Improper Input Validation, Use After Free, Out-of-bounds Read,
Red Hat
kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)
vendor_redhat·2024-12-17·CVSS 5.5
CVE-2024-53241 [MEDIUM] CWE-119 kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)
kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)
In the Linux kernel, the following vulnerability has been resolved:
x86/xen: don't do PV iret hypercall through hypercall page
Instead of jumping to the Xen hypercall page for doing the iret
hypercall, directly code the required sequence in xen-asm.S.
This is done in preparation of no longer using hypercall page at all,
as it has shown to cause problems with speculation mitigations.
This is part of XSA-466 / CVE-2024-53241.
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Out of support scope
Package: kernel-rt (Red Hat Enterprise Linux 7) - Out of support scope
Package: kernel-rt (Red Hat Enterprise Linux 9) - Will not fix
P
Debian
CVE-2024-53241: linux - In the Linux kernel, the following vulnerability has been resolved: x86/xen: do...
vendor_debian·2024·CVSS 5.5
CVE-2024-53241 [MEDIUM] CVE-2024-53241: linux - In the Linux kernel, the following vulnerability has been resolved: x86/xen: do...
In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV iret hypercall through hypercall page Instead of jumping to the Xen hypercall page for doing the iret hypercall, directly code the required sequence in xen-asm.S. This is done in preparation of no longer using hypercall page at all, as it has shown to cause problems with speculation mitigations. This is part of XSA-466 / CVE-2024-53241.
Scope: local
bookworm: resolved (fixed in 6.1.123-1)
bullseye: resolved (fixed in 5.10.234-1)
forky: resolved (fixed in 6.12.6-1)
sid: resolved (fixed in 6.12.6-1)
trixie: resolved (fixed in 6.12.6-1)
OSV
CVE-2024-53241: In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV iret hypercall through hypercall page Instead of jumping to t
osv·2024-12-24·CVSS 5.5
CVE-2024-53241 [MEDIUM] CVE-2024-53241: In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV iret hypercall through hypercall page Instead of jumping to t
In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV iret hypercall through hypercall page Instead of jumping to the Xen hypercall page for doing the iret hypercall, directly code the required sequence in xen-asm.S. This is done in preparation of no longer using hypercall page at all, as it has shown to cause problems with speculation mitigations. This is part of XSA-466 / CVE-2024-53241.
GHSA
GHSA-w2vx-fp9q-36ph: In the Linux kernel, the following vulnerability has been resolved:
x86/xen: don't do PV iret hypercall through hypercall page
Instead of jumping to
ghsa_unreviewed·2024-12-24·CVSS 5.5
CVE-2024-53241 [MEDIUM] GHSA-w2vx-fp9q-36ph: In the Linux kernel, the following vulnerability has been resolved:
x86/xen: don't do PV iret hypercall through hypercall page
Instead of jumping to
In the Linux kernel, the following vulnerability has been resolved:
x86/xen: don't do PV iret hypercall through hypercall page
Instead of jumping to the Xen hypercall page for doing the iret
hypercall, directly code the required sequence in xen-asm.S.
This is done in preparation of no longer using hypercall page at all,
as it has shown to cause problems with speculation mitigations.
This is part of XSA-466 / CVE-2024-53241.
Kernel
objtool/x86: allow syscall instruction
kernel_security·2024-11-29·CVSS 5.5
CVE-2024-53241 [MEDIUM] objtool/x86: allow syscall instruction
objtool/x86: allow syscall instruction
The syscall instruction is used in Xen PV mode for doing hypercalls.
Allow syscall to be used in the kernel in case it is tagged with an
unwind hint for objtool.
This is part of XSA-466 / CVE-2024-53241.
Reported-by: Andrew Cooper
Signed-off-by: Juergen Gross
Co-developed-by: Peter Zijlstra
Kernel
x86/static-call: provide a way to do very early static-call updates
kernel_security·2024-11-29·CVSS 5.5
CVE-2024-53241 [MEDIUM] x86/static-call: provide a way to do very early static-call updates
x86/static-call: provide a way to do very early static-call updates
Add static_call_update_early() for updating static-call targets in
very early boot.
This will be needed for support of Xen guest type specific hypercall
functions.
This is part of XSA-466 / CVE-2024-53241.
Reported-by: Andrew Cooper
Signed-off-by: Juergen Gross
Co-developed-by: Peter Zijlstra
Co-developed-by: Josh Poimboeuf
Kernel
x86/xen: remove hypercall page
kernel_security·2024-10-17·CVSS 5.5
CVE-2024-53241 [MEDIUM] x86/xen: remove hypercall page
x86/xen: remove hypercall page
The hypercall page is no longer needed. It can be removed, as from the
Xen perspective it is optional.
But, from Linux's perspective, it removes naked RET instructions that
escape the speculative protections that Call Depth Tracking and/or
Untrain Ret are trying to achieve.
This is part of XSA-466 / CVE-2024-53241.
Reported-by: Andrew Cooper
Signed-off-by: Juergen Gross
Reviewed-by: Andrew Cooper
Reviewed-by: Jan Beulich
Kernel
x86/xen: add central hypercall functions
kernel_security·2024-10-17·CVSS 5.5
CVE-2024-53241 [MEDIUM] x86/xen: add central hypercall functions
x86/xen: add central hypercall functions
Add generic hypercall functions usable for all normal (i.e. not iret)
hypercalls. Depending on the guest type and the processor vendor
different functions need to be used due to the to be used instruction
for entering the hypervisor:
- PV guests need to use syscall
- HVM/PVH guests on Intel need to use vmcall
- HVM/PVH guests on AMD and Hygon need to use vmmcall
As PVH guests need to issue hypercalls very early during boot, there
is a 4th hypercall function needed for HVM/PVH which can be used on
Intel and AMD processors. It will check the vendor type and then set
the Intel or AMD specific function to use via static_call().
This is part of XSA-466 / CVE-2024-53241.
Reported-by: Andrew Cooper
Signed-off-by: Juergen Gross
Co-developed-by: Peter Z
Kernel
x86: make get_cpu_vendor() accessible from Xen code
kernel_security·2024-10-17·CVSS 5.5
CVE-2024-53241 [MEDIUM] x86: make get_cpu_vendor() accessible from Xen code
x86: make get_cpu_vendor() accessible from Xen code
In order to be able to differentiate between AMD and Intel based
systems for very early hypercalls without having to rely on the Xen
hypercall page, make get_cpu_vendor() non-static.
Refactor early_cpu_init() for the same reason by splitting out the
loop initializing cpu_devs() into an externally callable function.
This is part of XSA-466 / CVE-2024-53241.
Reported-by: Andrew Cooper
Signed-off-by: Juergen Gross
Kernel
x86/xen: use new hypercall functions instead of hypercall page
kernel_security·2024-10-17·CVSS 5.5
CVE-2024-53241 [MEDIUM] x86/xen: use new hypercall functions instead of hypercall page
x86/xen: use new hypercall functions instead of hypercall page
Call the Xen hypervisor via the new xen_hypercall_func static-call
instead of the hypercall page.
This is part of XSA-466 / CVE-2024-53241.
Reported-by: Andrew Cooper
Signed-off-by: Juergen Gross
Co-developed-by: Peter Zijlstra
Co-developed-by: Josh Poimboeuf
Kernel
x86/xen: don't do PV iret hypercall through hypercall page
kernel_security·2024-10-16·CVSS 5.5
CVE-2024-53241 [MEDIUM] x86/xen: don't do PV iret hypercall through hypercall page
x86/xen: don't do PV iret hypercall through hypercall page
Instead of jumping to the Xen hypercall page for doing the iret
hypercall, directly code the required sequence in xen-asm.S.
This is done in preparation of no longer using hypercall page at all,
as it has shown to cause problems with speculation mitigations.
This is part of XSA-466 / CVE-2024-53241.
Reported-by: Andrew Cooper
Signed-off-by: Juergen Gross
Reviewed-by: Jan Beulich
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/05df6e6cd9a76b778aee33c3c18c9f3b3566d4a5https://git.kernel.org/stable/c/82c211ead1ec440dbf81727e17b03b5e3c44b93dhttps://git.kernel.org/stable/c/a2796dff62d6c6bfc5fbebdf2bee0d5ac0438906https://git.kernel.org/stable/c/c7b4cfa6213a44fa48714186dfdf125072d036e3https://git.kernel.org/stable/c/f7c3fdad0a474062d566aae3289d490d7e702d30https://git.kernel.org/stable/c/fa719857f613fed94a79da055b13ca51214c694fhttp://www.openwall.com/lists/oss-security/2024/12/17/2http://www.openwall.com/lists/oss-security/2024/12/23/1http://www.openwall.com/lists/oss-security/2025/01/05/1http://www.openwall.com/lists/oss-security/2025/01/05/2http://xenbits.xen.org/xsa/advisory-466.htmlhttps://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlhttps://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
2024-12-24
Published