CVE-2024-31146 PCI device pass-through with shared resources
Xen hypervisor lacks explicit security support for PCI device pass-through with shared resources, requiring configuration changes to mitigate risks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-31146?
CVE-2024-31146 is a high-severity vulnerability in Xen Xen, published on 25 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
When multiple devices share resources and one of them is to be passed through to a guest, security of the entire system and of respective guests individually cannot really be guaranteed without knowing internals of any of the involved guests. Therefore such a configuration cannot really be security-supported, yet making that explicit was so far missing.
Resources the sharing of which is known to be problematic include, but are not limited to - - PCI Base Address Registers (BARs) of multiple devices mapping to the same page (4k on x86), - - INTx lines.
Weakness: CWE-400
Which versions are affected by CVE-2024-31146?
It affects 1 product.
Products include Xen Xen.
How do I fix CVE-2024-31146?
Change a configuration setting.
Is CVE-2024-31146 being exploited?
There is no known exploitation of CVE-2024-31146 in the wild and no public exploit code.
Other vulnerabilities in Xen Xen
Sources
Also known as DEBIAN-CVE-2024-31146, GHSA-hrw6-9556-27w2, UBUNTU-CVE-2024-31146.