high 7.1

CVE-2024-53111 json

mm/mremap: fix address wraparound in move_page_tables()

published 2024-12-02 23 mo ago modified 2026-08-05 3 mo ago also EUVD-2024-51783

cvss: 7.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

On 32-bit platforms, it is possible for the expression `len + old_addr < old_end` to be false-positive if `len + old_addr` wraps around. `old_addr` is the cursor in the old range up to which page table entries have been moved; so if the operation succeeded, `old_addr` is the *end* of the old region, and adding `len` to it can wrap.

The overflow causes mremap() to mistakenly believe that PTEs have been copied; the consequence is that mremap() bails out, but doesn't move the PTEs back before the new VMA is unmapped, causing anonymous pages in the region to be lost. So basically if userspace tries to mremap() a private-anon region and hits this bug, mremap() will return an error and the private-anon region's contents appear to have been zeroed.

The idea of this check is that `old_end - len` is the original start address, and writing the check that way also makes it easier to read; so fix the check by rearranging the comparison accordingly.

(An alternate fix would be to refactor this function by introducing an "orig_old_start" variable or such.)

Tested in a VM with a 32-bit X86 kernel; without the patch:

``` user@horn:~/big_mremap$ cat test.c #define _GNU_SOURCE #include <stdlib.h> #include <stdio.h> #include <err.h> #include <sys/mman.h>

#define ADDR1 ((void*)0x60000000) #define ADDR2 ((void*)0x10000000) #define SIZE 0x50000000uL

int main(void) { unsigned char *p1 = mmap(ADDR1, SIZE, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE|MAP_FIXED_NOREPLACE, -1, 0); if (p1 == MAP_FAILED) err(1, "mmap 1"); unsigned char *p2 = mmap(ADDR2, SIZE, PROT_NONE, MAP_ANONYMOUS|MAP_PRIVATE|MAP_FIXED_NOREPLACE, -1, 0); if (p2 == MAP_FAILED) err(1, "mmap 2"); *p1 = 0x41; printf("first char is 0x%02hhx\n", *p1); unsigned char *p3 = mremap(p1, SIZE, SIZE, MREMAP_MAYMOVE|MREMAP_FIXED, p2); if (p3 == MAP_FAILED) { printf("mremap() failed; first char is 0x%02hhx\n", *p1); } else { printf("mremap() succeeded; first char is 0x%02hhx\n", *p3); } } user@horn:~/big_mremap$ gcc -static -o test test.c user@horn:~/big_mremap$ setarch -R ./test first char is 0x41 mremap() failed; first char is 0x00 ```

With the patch:

``` user@horn:~/big_mremap$ setarch -R ./test first char is 0x41 mremap() succeeded; first char is 0x41 ```

Patch / fix

fixed in 1 distros 3 links 2

Linux Linux 6.11.10, 6.12

debian ubuntu suse

linux Debian 14, Debian 13 6.11.10-1

debian advisories DEBIAN-CVE-2024-53111

linux Ubuntu 24.04 LTS 6.8.0-58.60
linux-aws Ubuntu 24.04 LTS 6.8.0-1027.29
linux-gcp Ubuntu 24.04 LTS 6.8.0-1028.30
linux-gke Ubuntu 24.04 LTS 6.8.0-1023.27
linux-ibm Ubuntu 24.04 LTS 6.8.0-1024.24
linux-azure Ubuntu 24.04 LTS 6.8.0-1027.32
linux-gkeop Ubuntu 24.04 LTS 6.8.0-1010.12
linux-raspi Ubuntu 24.04 LTS 6.8.0-1028.32

ubuntu advisories UBUNTU-CVE-2024-53111

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-25.1
kernel-source-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-25.1
kernel-livepatch-MICRO-6-0-RT_Update_5 Linux Micro 6.1, Linux Micro 6.0 1-1.1
kernel-source Linux Micro 6.1, Linux Micro 6.0 6.4.0-25.1
kernel-default Linux Micro 6.1, Linux Micro 6.0 6.4.0-25.1
kernel-kvmsmall Linux Micro 6.1, Linux Micro 6.0 6.4.0-25.1
kernel-default-base Linux Micro 6.1, Linux Micro 6.0 6.4.0-24.1.21.4
kernel-livepatch-MICRO-6-0_Update_5 Linux Micro 6.1, Linux Micro 6.0 1-1.2

suse advisories SUSE-SU-2025:20166-1 SUSE-SU-2025:20249-1 SUSE-SU-2025:20165-1 SUSE-SU-2025:20248-1 SUSE-SU-2025:0289-1 SUSE-SU-2025:0154-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-53111 updated 2026-11-05 cvss 5.5

kernel: mm/mremap: fix address wraparound in move_page_tables()

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 13 mo ago (2025-10-01)

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CISA ADP	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux

Classification

Weakness

CWE-190 Integer Overflow or Wraparound

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2024-53111
NVD CVE-2024-53111

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary