Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2024-0564

Kernel: max page sharing of kernel samepage merging (ksm) may cause memory deduplication

Medium5.3EPSS 0.62%
Published
Updated
Reserved
Assigned by
redhat

Description

A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version 4.4.0-96.119, can create a side channel. When the attacker and the victim share the same host and the default setting of KSM is "max page sharing=256", it is possible for the attacker to time the unmap to merge with the victim's page. The unmapping time depends on whether it merges with the victim's page and additional physical pages are created beyond the KSM's "max page share". Through these operations, the attacker can leak the victim's page.

Timeline

  1. ID reserved

    By redhat

  2. · 15 days later

    Published

  3. · 3 years later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2024-0564, by who scored it
Scored byCVSSScoreVector
redhatCNA (assigner)3.1Medium5.3CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Modified3.1Medium6.5CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS (exploitation in 30 days)
0.62% · top 50% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

Affected products

What to do

Workaround: The mitigation shown below has a potentially significant impact on system performance and stability. It should be carefully tested prior to deployment: - Deactivation of memory deduplication Deactivating memory deduplication will effectively mitigate all attack vectors. This measure unfortunately eliminates all the highly appreciated benefits of memory deduplication, namely the increase of operational cost-effectiveness through inter-VM memory sharing. This will cause an increase in the amount of memory required and in some situations may adversely impact performance (e.g. due to slower swap space being used). It is recommended that customers test this workaround before using it in production. See https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/virtualization_tuning_and_optimization_guide/sect-ksm-deactivating_ksm for how to disable KSM from Red Hat Enterprise Linux 6 and newer. - Disabling services and firewall rules. The attack uses the response time of services on the system. By limiting access to services an attacker must connect to the service to successful carry out the exploit. Reducing the number of systems that are allowed to connect to the service will prevent an attack from working when launched outside an allowed ranges. While this does not prevent an attack from working, it will reduce the amount of systems that an attacker can launch an attack from.

References (5)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2024-0564 badge
[![CVE-2024-0564](https://trackcve.app/badge/CVE-2024-0564.svg)](https://trackcve.app/cve/CVE-2024-0564)

Record last updated .