CVE-2024-35987 (GCVE-0-2024-35987)

Vulnerability from cvelistv5 – Published: 2024-05-20 09:47 – Updated: 2026-08-05 11:31
VLAI
Title
riscv: Fix loading 64-bit NOMMU kernels past the start of RAM
Summary
In the Linux kernel, the following vulnerability has been resolved: riscv: Fix loading 64-bit NOMMU kernels past the start of RAM commit 3335068f8721 ("riscv: Use PUD/P4D/PGD pages for the linear mapping") added logic to allow using RAM below the kernel load address. However, this does not work for NOMMU, where PAGE_OFFSET is fixed to the kernel load address. Since that range of memory corresponds to PFNs below ARCH_PFN_OFFSET, mm initialization runs off the beginning of mem_map and corrupts adjacent kernel memory. Fix this by restoring the previous behavior for NOMMU kernels.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-21 15:11 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3335068f87217ea59d08f462187dc856652eea15 , < b008e327fa570aca210f98c817757649bae56694 (git)
Affected: 3335068f87217ea59d08f462187dc856652eea15 , < ea6628e4e2353978af7e3b4ad4fdaab6149acf3d (git)
Affected: 3335068f87217ea59d08f462187dc856652eea15 , < aea702dde7e9876fb00571a2602f25130847bf0f (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.30 , ≤ 6.6.* (semver)
Unaffected: 6.8.9 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35987",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T15:11:39.923129Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:34:49.643Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:12.480Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b008e327fa570aca210f98c817757649bae56694"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ea6628e4e2353978af7e3b4ad4fdaab6149acf3d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aea702dde7e9876fb00571a2602f25130847bf0f"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/riscv/include/asm/page.h",
            "arch/riscv/mm/init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b008e327fa570aca210f98c817757649bae56694",
              "status": "affected",
              "version": "3335068f87217ea59d08f462187dc856652eea15",
              "versionType": "git"
            },
            {
              "lessThan": "ea6628e4e2353978af7e3b4ad4fdaab6149acf3d",
              "status": "affected",
              "version": "3335068f87217ea59d08f462187dc856652eea15",
              "versionType": "git"
            },
            {
              "lessThan": "aea702dde7e9876fb00571a2602f25130847bf0f",
              "status": "affected",
              "version": "3335068f87217ea59d08f462187dc856652eea15",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/riscv/include/asm/page.h",
            "arch/riscv/mm/init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.30",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.9",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: Fix loading 64-bit NOMMU kernels past the start of RAM\n\ncommit 3335068f8721 (\"riscv: Use PUD/P4D/PGD pages for the linear\nmapping\") added logic to allow using RAM below the kernel load address.\nHowever, this does not work for NOMMU, where PAGE_OFFSET is fixed to the\nkernel load address. Since that range of memory corresponds to PFNs\nbelow ARCH_PFN_OFFSET, mm initialization runs off the beginning of\nmem_map and corrupts adjacent kernel memory. Fix this by restoring the\nprevious behavior for NOMMU kernels."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The corruption occurs in `setup_bootmem()`/`free_area_init()` on the local machine\u0027s own boot path, with no network, adjacent-network, or remote-peer data anywhere in the path; anyone able to power-cycle or reset an affected RISC-V NOMMU board triggers it, and no device insertion or physical bus access is involved, so it scores L rather than P.\nAC:L - On an affected deployment (64-bit RISC-V NOMMU with RAM below the kernel load address) the failure is fully deterministic on every single boot \u2014 `min_low_pfn \u003c ARCH_PFN_OFFSET` forces the negative `__pfn_to_page()` index unconditionally, with no race, timing window, or memory-layout grooming required.\nPR:N - The corrupting code runs during early memory-management initialization, long before userspace, login, or any credential check exists, so no account, capability, or namespace gates it.\nUI:N - Both `setup_bootmem()` and mm initialization execute autonomously as part of kernel startup; no administrator or user has to mount anything, open a device node, or take any action.\nS:U - The out-of-bounds writes and the skewed `__va`/`__pa` translation both corrupt the kernel\u0027s own memory and allocator state, remaining entirely within the kernel\u0027s security authority \u2014 no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Corrupted `struct page` metadata and a systematically wrong `kernel_map.va_pa_offset` make `pfn_to_page()`/`page_address()`/`virt_to_phys()` resolve to the wrong physical memory, so the page allocator can hand out pages still holding kernel data; on NOMMU there is no MMU-enforced separation to prevent a user process from reading that kernel memory.\nI:H - `__init_single_page()` writes roughly 64 bytes of page flags, refcounts, and list pointers per PFN at a negative index before `mem_map`, giving an out-of-bounds write into adjacent kernel memory, and the wrong `va_pa_offset` additionally directs DMA and linear-map writes to incorrect physical addresses.\nA:H - The commit states mm initialization \"corrupts adjacent kernel memory\"; the resulting damage to page-allocator structures plus universally wrong physical-address translation renders the system unbootable or crashes it, and recurs on every boot while the affected memory layout is present."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:25.006Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b008e327fa570aca210f98c817757649bae56694"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea6628e4e2353978af7e3b4ad4fdaab6149acf3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/aea702dde7e9876fb00571a2602f25130847bf0f"
        }
      ],
      "title": "riscv: Fix loading 64-bit NOMMU kernels past the start of RAM",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35987",
    "datePublished": "2024-05-20T09:47:53.717Z",
    "dateReserved": "2024-05-17T13:50:33.145Z",
    "dateUpdated": "2026-08-05T11:31:25.006Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35987",
      "date": "2026-09-30",
      "epss": "0.00225",
      "percentile": "0.11871"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: Fix loading 64-bit NOMMU kernels past the start of RAM\n\ncommit 3335068f8721 (\"riscv: Use PUD/P4D/PGD pages for the linear\nmapping\") added logic to allow using RAM below the kernel load address.\nHowever, this does not work for NOMMU, where PAGE_OFFSET is fixed to the\nkernel load address. Since that range of memory corresponds to PFNs\nbelow ARCH_PFN_OFFSET, mm initialization runs off the beginning of\nmem_map and corrupts adjacent kernel memory. Fix this by restoring the\nprevious behavior for NOMMU kernels."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: riscv: se corrigi\u00f3 la carga de kernels NOMMU de 64 bits despu\u00e9s del inicio de la confirmaci\u00f3n de RAM. 3335068f8721 (\"riscv: use p\u00e1ginas PUD/P4D/PGD para el mapeo lineal\") se agreg\u00f3 l\u00f3gica para permitir el uso RAM debajo de la direcci\u00f3n de carga del kernel. Sin embargo, esto no funciona para NOMMU, donde PAGE_OFFSET est\u00e1 fijado a la direcci\u00f3n de carga del kernel. Dado que ese rango de memoria corresponde a los PFN por debajo de ARCH_PFN_OFFSET, la inicializaci\u00f3n de mm se ejecuta desde el principio de mem_map y corrompe la memoria del kernel adyacente. Solucione este problema restaurando el comportamiento anterior de los n\u00facleos NOMMU."
        }
      ],
      "id": "CVE-2024-35987",
      "lastModified": "2024-11-21T09:21:22.200",
      "published": "2024-05-20T10:15:13.057",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/aea702dde7e9876fb00571a2602f25130847bf0f"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/b008e327fa570aca210f98c817757649bae56694"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/ea6628e4e2353978af7e3b4ad4fdaab6149acf3d"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/aea702dde7e9876fb00571a2602f25130847bf0f"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/b008e327fa570aca210f98c817757649bae56694"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/ea6628e4e2353978af7e3b4ad4fdaab6149acf3d"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/riscv/include/asm/page.h",
                  "arch/riscv/mm/init.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b008e327fa570aca210f98c817757649bae56694",
                    "status": "affected",
                    "version": "3335068f87217ea59d08f462187dc856652eea15",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ea6628e4e2353978af7e3b4ad4fdaab6149acf3d",
                    "status": "affected",
                    "version": "3335068f87217ea59d08f462187dc856652eea15",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "aea702dde7e9876fb00571a2602f25130847bf0f",
                    "status": "affected",
                    "version": "3335068f87217ea59d08f462187dc856652eea15",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/riscv/include/asm/page.h",
                  "arch/riscv/mm/init.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.4"
                  },
                  {
                    "lessThan": "6.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.30",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.8.*",
                    "status": "unaffected",
                    "version": "6.8.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.9",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "690AEB51-07F0-40A3-9967-DE94D673735E",
                    "versionEndExcluding": "6.6.30",
                    "versionStartIncluding": "6.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5F9041E5-8358-4EF7-8F98-B812EDE49612",
                    "versionEndExcluding": "6.8.9",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "A06B2CCF-3F43-4FA9-8773-C83C3F5764B2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "F850DCEC-E08B-4317-A33B-D2DCF39F601B",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: Fix loading 64-bit NOMMU kernels past the start of RAM\n\ncommit 3335068f8721 (\"riscv: Use PUD/P4D/PGD pages for the linear\nmapping\") added logic to allow using RAM below the kernel load address.\nHowever, this does not work for NOMMU, where PAGE_OFFSET is fixed to the\nkernel load address. Since that range of memory corresponds to PFNs\nbelow ARCH_PFN_OFFSET, mm initialization runs off the beginning of\nmem_map and corrupts adjacent kernel memory. Fix this by restoring the\nprevious behavior for NOMMU kernels."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: riscv: se corrigi\u00f3 la carga de kernels NOMMU de 64 bits despu\u00e9s del inicio de la confirmaci\u00f3n de RAM. 3335068f8721 (\"riscv: use p\u00e1ginas PUD/P4D/PGD para el mapeo lineal\") se agreg\u00f3 l\u00f3gica para permitir el uso RAM debajo de la direcci\u00f3n de carga del kernel. Sin embargo, esto no funciona para NOMMU, donde PAGE_OFFSET est\u00e1 fijado a la direcci\u00f3n de carga del kernel. Dado que ese rango de memoria corresponde a los PFN por debajo de ARCH_PFN_OFFSET, la inicializaci\u00f3n de mm se ejecuta desde el principio de mem_map y corrompe la memoria del kernel adyacente. Solucione este problema restaurando el comportamiento anterior de los n\u00facleos NOMMU."
          }
        ],
        "id": "CVE-2024-35987",
        "lastModified": "2026-08-04T11:18:19.157",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-35987",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T15:11:39.923129Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-20T10:15:13.057",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/aea702dde7e9876fb00571a2602f25130847bf0f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b008e327fa570aca210f98c817757649bae56694"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ea6628e4e2353978af7e3b4ad4fdaab6149acf3d"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/aea702dde7e9876fb00571a2602f25130847bf0f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b008e327fa570aca210f98c817757649bae56694"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ea6628e4e2353978af7e3b4ad4fdaab6149acf3d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:57:22+00:00",
      "cve": "CVE-2024-35987",
      "id": "CVE-2024-35987",
      "initial_release_date": "2024-05-20T00:00:00+00:00",
      "product_status:known_affected": "28",
      "product_status:known_not_affected": "170",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: riscv: Fix loading 64-bit NOMMU kernels past the start of RAM",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35987.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2025-07-02T00:30:02Z",
      "cve": "CVE-2024-35987",
      "id": "CVE-2024-35987",
      "initial_release_date": "2024-05-21T01:58:28Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-35987",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35987.json",
      "version": "14"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T03:30:12.480Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/b008e327fa570aca210f98c817757649bae56694"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/ea6628e4e2353978af7e3b4ad4fdaab6149acf3d"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/aea702dde7e9876fb00571a2602f25130847bf0f"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-35987",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-05-21T15:11:39.923129Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-23T19:01:25.150Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "arch/riscv/include/asm/page.h",
                "arch/riscv/mm/init.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "b008e327fa570aca210f98c817757649bae56694",
                  "status": "affected",
                  "version": "3335068f87217ea59d08f462187dc856652eea15",
                  "versionType": "git"
                },
                {
                  "lessThan": "ea6628e4e2353978af7e3b4ad4fdaab6149acf3d",
                  "status": "affected",
                  "version": "3335068f87217ea59d08f462187dc856652eea15",
                  "versionType": "git"
                },
                {
                  "lessThan": "aea702dde7e9876fb00571a2602f25130847bf0f",
                  "status": "affected",
                  "version": "3335068f87217ea59d08f462187dc856652eea15",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "arch/riscv/include/asm/page.h",
                "arch/riscv/mm/init.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.4"
                },
                {
                  "lessThan": "6.4",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.30",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.8.*",
                  "status": "unaffected",
                  "version": "6.8.9",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.9",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.30",
                      "versionStartIncluding": "6.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8.9",
                      "versionStartIncluding": "6.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.9",
                      "versionStartIncluding": "6.4",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: Fix loading 64-bit NOMMU kernels past the start of RAM\n\ncommit 3335068f8721 (\"riscv: Use PUD/P4D/PGD pages for the linear\nmapping\") added logic to allow using RAM below the kernel load address.\nHowever, this does not work for NOMMU, where PAGE_OFFSET is fixed to the\nkernel load address. Since that range of memory corresponds to PFNs\nbelow ARCH_PFN_OFFSET, mm initialization runs off the beginning of\nmem_map and corrupts adjacent kernel memory. Fix this by restoring the\nprevious behavior for NOMMU kernels."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The corruption occurs in `setup_bootmem()`/`free_area_init()` on the local machine\u0027s own boot path, with no network, adjacent-network, or remote-peer data anywhere in the path; anyone able to power-cycle or reset an affected RISC-V NOMMU board triggers it, and no device insertion or physical bus access is involved, so it scores L rather than P.\nAC:L - On an affected deployment (64-bit RISC-V NOMMU with RAM below the kernel load address) the failure is fully deterministic on every single boot \u2014 `min_low_pfn \u003c ARCH_PFN_OFFSET` forces the negative `__pfn_to_page()` index unconditionally, with no race, timing window, or memory-layout grooming required.\nPR:N - The corrupting code runs during early memory-management initialization, long before userspace, login, or any credential check exists, so no account, capability, or namespace gates it.\nUI:N - Both `setup_bootmem()` and mm initialization execute autonomously as part of kernel startup; no administrator or user has to mount anything, open a device node, or take any action.\nS:U - The out-of-bounds writes and the skewed `__va`/`__pa` translation both corrupt the kernel\u0027s own memory and allocator state, remaining entirely within the kernel\u0027s security authority \u2014 no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Corrupted `struct page` metadata and a systematically wrong `kernel_map.va_pa_offset` make `pfn_to_page()`/`page_address()`/`virt_to_phys()` resolve to the wrong physical memory, so the page allocator can hand out pages still holding kernel data; on NOMMU there is no MMU-enforced separation to prevent a user process from reading that kernel memory.\nI:H - `__init_single_page()` writes roughly 64 bytes of page flags, refcounts, and list pointers per PFN at a negative index before `mem_map`, giving an out-of-bounds write into adjacent kernel memory, and the wrong `va_pa_offset` additionally directs DMA and linear-map writes to incorrect physical addresses.\nA:H - The commit states mm initialization \"corrupts adjacent kernel memory\"; the resulting damage to page-allocator structures plus universally wrong physical-address translation renders the system unbootable or crashes it, and recurs on every boot while the affected memory layout is present."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:31:25.006Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/b008e327fa570aca210f98c817757649bae56694"
            },
            {
              "url": "https://git.kernel.org/stable/c/ea6628e4e2353978af7e3b4ad4fdaab6149acf3d"
            },
            {
              "url": "https://git.kernel.org/stable/c/aea702dde7e9876fb00571a2602f25130847bf0f"
            }
          ],
          "title": "riscv: Fix loading 64-bit NOMMU kernels past the start of RAM",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-35987",
        "datePublished": "2024-05-20T09:47:53.717Z",
        "dateReserved": "2024-05-17T13:50:33.145Z",
        "dateUpdated": "2026-08-05T11:31:25.006Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.