CVE-2024-31143 double unlock in x86 guest IRQ handling
A double unlock error in Xen's PCI MSI handling can cause a denial of service in x86 guest IRQ processing.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-31143?
CVE-2024-31143 is a high-severity vulnerability in Xen Xen, published on 18 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An optional feature of PCI MSI called "Multiple Message" allows a device to use multiple consecutive interrupt vectors. Unlike for MSI-X, the setting up of these consecutive vectors needs to happen all in one go. In this handling an error path could be taken in different situations, with or without a particular lock held. This error path wrongly releases the lock even when it is not currently held.
Weakness: CWE-832
Which versions are affected by CVE-2024-31143?
It affects 1 product.
Linux distribution packages (1)
xen openSUSE:Tumbleweed | All versions | 4.18.2_06-2.1 |
Products include Xen Xen.
How do I fix CVE-2024-31143?
Apply the vendor's patch.
Is CVE-2024-31143 being exploited?
There is no known exploitation of CVE-2024-31143 in the wild and no public exploit code.
Other vulnerabilities in Xen Xen
Sources
Also known as ALPINE-CVE-2024-31143, DEBIAN-CVE-2024-31143, GHSA-cjq8-723f-8fmv, UBUNTU-CVE-2024-31143, openSUSE-SU-2024:14204-1.