What’s Vulnerable › Vulnerabilities
CVE-2024-11263: arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=y
- Severity: high (CVSS 8.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-11-15 · updated 2026-06-17
- Weakness: CWE-270
Description
When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.
Affected products
- zephyrproject zephyr: through 3.7.0
References
Get alerted when CVE-2024-11263 or the next vulnerability affects your stack