CVE-2024-0564

A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version 4.4.0-96.119, can create a side channel. When the attacker and the victim share the same host and the default setting of KSM is "max page sharing=256", it is possible for the attacker to time the unmap to merge with the victim's page. The unmapping time depends on whether it merges with the victim's page and additional physical pages are created beyond the KSM's "max page share". Through these operations, the attacker can leak the victim's page.

• CWE-203
• CWE-203

• https://access.redhat.com/security/cve/CVE-2024-0564Third Party Advisory
• https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1680513Exploit, Issue Tracking
• https://bugzilla.redhat.com/show_bug.cgi?id=2258514Issue Tracking
• https://link.springer.com/conference/wisaNot Applicable
• https://wisa.or.kr/acceptedNot Applicable
• https://access.redhat.com/security/cve/CVE-2024-0564Third Party Advisory
• https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1680513Exploit, Issue Tracking
• https://bugzilla.redhat.com/show_bug.cgi?id=2258514Issue Tracking
• https://link.springer.com/conference/wisaNot Applicable
• https://wisa.or.kr/acceptedNot Applicable

Published

Jan 30, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-0558A vulnerability has been found in DedeBIZ 6.3.0 and classifi…7.2
• CVE-2024-0559The Enhanced Text Widget WordPress plugin before 1.6.6 does …6.5
• CVE-2024-0560A vulnerability was found in 3Scale, when used with Keycloak…4.3
• CVE-2024-0561The Ultimate Posts Widget WordPress plugin before 2.3.1 does…5.4
• CVE-2024-0562A use-after-free flaw was found in the Linux Kernel. When a …7.8
• CVE-2024-0563Denial of service condition in M-Files Server in versions be…6.5
• CVE-2024-0565An out-of-bounds memory read flaw was found in receive_encry…7.4
• CVE-2024-0566The Smart Manager WordPress plugin before 8.28.0 does not pr…7.2
• CVE-2024-0567A vulnerability was found in GnuTLS, where a cockpit (which …7.5
• CVE-2024-0568 CWE-287: Improper Authentication vulnerability exists that …8.8
• CVE-2024-0569A vulnerability classified as problematic has been found in …9.1
• CVE-2024-0570A vulnerability classified as critical was found in Totolink…9.1