CVE-2024-2201

A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems.

Score

CVSS 3.1 4.7 Medium

Status

Deferred - cret@cert.org

Published

2024-12-19

Last modified

2025-01-09

Affected products

• Xen (Xen)

References

• http://www.openwall.com/lists/oss-security/2024/04/09/15
• http://www.openwall.com/lists/oss-security/2024/05/07/7
• http://xenbits.xen.org/xsa/advisory-456.html
• https://github.com/vusec/inspectre-gadget?tab=readme-ov-file
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QKNCPX7CJUK4I6BRGABAUQK…
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D5OK6MH75S7YWD34EWW7QIZT…
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYAZ7P6YFJ2E3FHKAGIKHWS4…
• https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/branc…
• https://www.kb.cert.org/vuls/id/155143