{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2024-31146 in the wild and no public exploit code.","fix":"Change a configuration setting.","what":"CVE-2024-31146 is a high-severity vulnerability in Xen Xen, published on 25 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-31146 and fix it if it is affected.\n\nWhat it is: CVE-2024-31146 is a high-severity vulnerability in Xen Xen, published on 25 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-31146 in the wild and no public exploit code.\n\nAffected product: Xen Xen. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-31146/ (Markdown: https://insights.sbomify.com/CVE-2024-31146/index.md)","id":"CVE-2024-31146","markdown":"https://insights.sbomify.com/CVE-2024-31146/index.md","name":"CVE-2024-31146","record":{"aliases":["DEBIAN-CVE-2024-31146","GHSA-hrw6-9556-27w2","UBUNTU-CVE-2024-31146"],"analysis":{"component_type":"operating_system","fix_type":"configuration_change","impacts":["security_bypass"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Xen hypervisor","requires_auth":"high_privilege","summary":"Xen hypervisor lacks explicit security support for PCI device pass-through with shared resources, requiring configuration changes to mitigate risks.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"XEN","cpe":[{"product":"xen","vendor":"xen"}],"cvss":{"score":7.5,"severity":"high","source":"cisa-adp","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"description":"When multiple devices share resources and one of them is to be passed\nthrough to a guest, security of the entire system and of respective\nguests individually cannot really be guaranteed without knowing\ninternals of any of the involved guests.  Therefore such a configuration\ncannot really be security-supported, yet making that explicit was so far\nmissing.\n\nResources the sharing of which is known to be problematic include, but\nare not limited to\n- - PCI Base Address Registers (BARs) of multiple devices mapping to the\n  same page (4k on x86),\n- - INTx lines.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"PCI device pass-through with shared resources","id":"CVE-2024-31146","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"xen:xen","products":["xen:xen"],"type":"other","year":"2024"},"n_packages":0,"n_references":1,"next":{"headline":"Information disclosure in Intel(R) Graphics Driver software","id":"CVE-2024-31150"},"packages":[],"prev":{"headline":"error handling in x86 IOMMU identity mapping","id":"CVE-2024-31145"},"products":["Xen"],"published":"2024-09-25","related":[{"cvss_score":10,"headline":"Privilege escalation in n/a","id":"CVE-2017-10912","kev_date_added":null,"published":"2017-07-05"},{"cvss_score":10,"headline":"Memory corruption in n/a","id":"CVE-2017-10918","kev_date_added":null,"published":"2017-07-05"},{"cvss_score":10,"headline":"Memory corruption in n/a","id":"CVE-2017-10920","kev_date_added":null,"published":"2017-07-05"},{"cvss_score":10,"headline":"Memory corruption in n/a","id":"CVE-2017-10921","kev_date_added":null,"published":"2017-07-05"},{"cvss_score":9.8,"headline":"Mutiple vulnerabilities in the Viridian interface","id":"CVE-2025-27466","kev_date_added":null,"published":"2025-09-11"},{"cvss_score":9.8,"headline":"Mutiple vulnerabilities in the Viridian interface","id":"CVE-2025-58142","kev_date_added":null,"published":"2025-09-11"},{"cvss_score":9.8,"headline":"Mutiple vulnerabilities in the Viridian interface","id":"CVE-2025-58143","kev_date_added":null,"published":"2025-09-11"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2024-09-25","vendors":["Xen"]},"summary":"Xen hypervisor lacks explicit security support for PCI device pass-through with shared resources, requiring configuration changes to mitigate risks.","url":"https://insights.sbomify.com/CVE-2024-31146/"}