CVE-2024-49975

A flaw was found in the Linux kernel's uprobes subsystem. When allocating memory for user space probes, the kernel maps an uninitialized memory page into a user space virtual memory area (VMA). A local user can exploit this vulnerability to read uninitialized memory contents, resulting in an information disclosure that may expose sensitive kernel data.

A moderate information disclosure flaw was found in the Linux kernel's uprobes subsystem, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8 and 9, the kernel in Fedora, and the kernels used by Red Hat managed OpenShift cluster offerings. When a user-space probe (uprobe) is armed, the kernel's xol_add_vma() maps an uninitialized page allocated by __create_xol_area() into a user-space virtual memory area labeled "[uprobes]". On x86, this memory is readable even without VM_READ because VM_EXEC results in the same page-table protections as VM_EXEC|VM_READ, and a debugger can read the mapping regardless of its permissions. A local user who can inspect the memory of a process with an armed user-space probe can therefore read the contents of this uninitialized page, which may contain sensitive kernel data.

Red Hat rates this flaw as Moderate impact with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting that exploitation requires local access and results only in the disclosure of kernel memory contents, with no impact to integrity or availability. The NVD base score is also 5.5 (Moderate), although its vector measures availability rather than confidentiality impact, which does not match the information-disclosure nature of this flaw. Within the Red Hat portfolio, fixes were delivered for the RHEL 9.6 kernel stream and for Fedora, while fixes are not planned for the RHEL 8.10.z and RHEL 9.5.z kernel and kernel-rt streams or for the kernels in Red Hat managed OpenShift (ARO/OSD) clusters, and the RHEL 6 ELS and RHEL 7 ELS streams are out of support scope. Exposure is limited to systems where user-space probes are in use.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.