CVE-2024-46826

kernel: ELF: fix kernel.randomize_va_space double read

Loading…

Severity

Moderate

Red Hat Product Security

4.4

CVSS 3.1

Review impact separately from score.

Published · September 27, 2024

Updated · October 29, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ELF: fix kernel.randomize_va_space double read

ELF loader uses "randomize_va_space" twice. It is sysctl and can change at any moment, so 2 loads could see 2 different values in theory with unpredictable consequences.

Issue exactly one load for consistent value across one exec.

Statement

The security impact is limited, because only privileged user can trigger the bug.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 4.4
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 · Improper Input Validation