CVE-2024-57884

5.5 · MEDIUM

Published Jan 15, 2025 linux CWE-835 EPSS 0.21% (12th pctl) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-57884 is a medium-severity vulnerability affecting linux linux_kernel. It was published on January 15, 2025 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()

The task sometimes continues looping in throttle_direct_reclaim() because

allow_direct_reclaim(pgdat) keeps returning false.

#0 [ffff80002cb6f8d0] __switch_to at ffff8000080095ac

#1 [ffff80002cb6f900] __schedule at ffff800008abbd1c

#2 [ffff80002cb6f990] schedule at ffff800008abc50c

#3 [ffff80002cb6f9b0] throttle_direct_reclaim at ffff800008273550

#4 [ffff80002cb6fa20] try_to_free_pages at ffff800008277b68

#5 [ffff80002cb6fae0] __alloc_pages_nodemask at ffff8000082c4660

#6 [ffff80002cb6fc50] alloc_pages_vma at ffff8000082e4a98

#7 [ffff80002cb6fca0] do_anonymous_page at ffff80000829f5a8

#8 [ffff80002cb6fce0] __handle_mm_fault at ffff8000082a5974

#9 [ffff80002cb6fd90] handle_mm_fault at ffff8000082a5bd4

At this point, the pgdat contains the following two zones:

NODE: 4 ZONE: 0 ADDR: ffff00817fffe540 NAME: "

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 4.8, < 5.4.289	Affected

References

Ref git.kernel.org/stable/c/1ff2302e8aeac7f2eedb551d7a89617283b5c6b2 Ref git.kernel.org/stable/c/58d0d02dbc67438fc80223fdd7bbc49cf0733284 Ref git.kernel.org/stable/c/63eac98d6f0898229f515cb62fe4e4db2430e99c Ref git.kernel.org/stable/c/66cd37660ec34ec444fe42f2277330ae4a36bb19 Ref git.kernel.org/stable/c/6aaced5abd32e2a57cd94fd64f824514d0361da8 Ref git.kernel.org/stable/c/bfb701192129803191c9cd6cdd1f82cd07f8de2c Ref git.kernel.org/stable/c/d675fefbaec3815b3ae0af1bebd97f27df3a05c8 Ref lists.debian.org/debian-lts-announce/2025/03/msg00001.html Ref lists.debian.org/debian-lts-announce/2025/03/msg00002.html

Frequently Asked Questions

What is CVE-2024-57884?

CVE-2024-57884 is a medium-severity vulnerability affecting linux linux_kernel. It was published on January 15, 2025 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-57884?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-57884?

How can CyberStrike help with CVE-2024-57884?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-57884 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719