CVE-2024-49975

What it actually does

Maps an uninitialized kernel page allocated by __create_xol_area() into userspace via xol_add_vma(), allowing readable access to kernel memory on architectures like x86 even without VM_READ permissions.

Why it matters to the business

Attackers may obtain sensitive kernel memory contents, potentially leading to further system compromise or data exposure in affected Linux environments including Rocky Linux 8 deployments of PostgreSQL and related packages.

How an attack unfolds

An attacker with debugging capabilities or using uprobes triggers the creation of the XOL area, causing the uninitialized page to be mapped into userspace memory, which can then be read to leak kernel information; listed threat actors involved in 2024 zero-day campaigns and Linux kernel resource vulnerabilities may leverage this.

How to fix it

Update the Linux kernel to the fixed version f31f92107e5a8ecc8902705122c594e979a351fe. For Rocky Linux 8, upgrade pgaudit to 0:1.5.0-1.module+el8.5.0+684+c3892ef9, postgres-decoderbufs to 0:0.10.0-2.module+el8.5.0+684+c3892ef9, and postgresql to 0:13.3-1.module+el8.4.0+546+3620623e.

How to confirm the fix worked

Verify kernel version is updated to include commit f31f92107e5a8ecc8902705122c594e979a351fe and confirm the uprobes fix is present in source; test affected packages on Rocky Linux 8 for updated versions.

Typical attack path

1. Identify a target process for uprobe attachment or debugging
2. Trigger xol_add_vma() to map the uninitialized page
3. Read the mapped memory region to extract kernel data

How to detect it

Review kernel logs and process memory mappings for uprobe-related VMA activity or unexpected readable pages in user space; correlate with debugging or tracing tool usage.

What your security team should do

• Apply kernel and package updates immediately given the two-year publication window
• Audit systems using uprobes or debugging features for exposure
• Monitor EPSS trends and threat actor activity around Linux kernel vulnerabilities