GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-31143 (GCVE-0-2024-31143)

Vulnerability from cvelistv5 – Published: 2024-07-18 13:31 – Updated: 2025-04-26 20:03
VLAI
Title
double unlock in x86 guest IRQ handling
Summary
An optional feature of PCI MSI called "Multiple Message" allows a device to use multiple consecutive interrupt vectors. Unlike for MSI-X, the setting up of these consecutive vectors needs to happen all in one go. In this handling an error path could be taken in different situations, with or without a particular lock held. This error path wrongly releases the lock even when it is not currently held.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-21 13:31 UTC
CWE
  • CWE-832 - Unlock of a Resource that is not Locked
Assigner
References
Impacted products
Vendor Product Version CPE status
Xen Xen Unknown: consult Xen advisory XSA-458
guessed Create a notification for this product.
xen xen Affected: 4.4 , < 4.16 (custom)
    cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2024-07-16 11:59
Credits
This issue was discovered by Jan Beulich of SUSE.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-04-26T20:03:16.232Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://xenbits.xenproject.org/xsa/advisory-458.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/07/16/3"
          },
          {
            "url": "http://xenbits.xen.org/xsa/advisory-458.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "xen",
            "vendor": "xen",
            "versions": [
              {
                "lessThan": "4.16",
                "status": "affected",
                "version": "4.4",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-31143",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-21T13:31:44.467773Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-832",
                "description": "CWE-832 Unlock of a Resource that is not Locked",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-21T13:39:34.427Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-458"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Xen versions 4.4 and newer are vulnerable.  Xen versions 4.3 and older\nare not vulnerable.\n\nOnly x86 guest which have a multi-vector MSI capable device passed\nthrough to them can leverage the vulnerability.\n"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Jan Beulich of SUSE.\n"
        }
      ],
      "datePublic": "2024-07-16T11:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An optional feature of PCI MSI called \"Multiple Message\" allows a\ndevice to use multiple consecutive interrupt vectors.  Unlike for MSI-X,\nthe setting up of these consecutive vectors needs to happen all in one\ngo.  In this handling an error path could be taken in different\nsituations, with or without a particular lock held.  This error path\nwrongly releases the lock even when it is not currently held.\n"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Denial of Service (DoS) affecting the entire host, crashes, information\nleaks, or elevation of privilege all cannot be ruled out.\n"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-18T13:31:31.244Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-458.html"
        }
      ],
      "title": "double unlock in x86 guest IRQ handling",
      "workarounds": [
        {
          "lang": "en",
          "value": "Not passing through multi-vector MSI capable devices to x86 guests will\navoid the vulnerability.\n"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2024-31143",
    "datePublished": "2024-07-18T13:31:31.244Z",
    "dateReserved": "2024-03-28T18:14:12.892Z",
    "dateUpdated": "2025-04-26T20:03:16.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-31143",
      "date": "2026-09-16",
      "epss": "0.00507",
      "percentile": "0.42061"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"An optional feature of PCI MSI called \\\"Multiple Message\\\" allows a\\ndevice to use multiple consecutive interrupt vectors.  Unlike for MSI-X,\\nthe setting up of these consecutive vectors needs to happen all in one\\ngo.  In this handling an error path could be taken in different\\nsituations, with or without a particular lock held.  This error path\\nwrongly releases the lock even when it is not currently held.\\n\"}, {\"lang\": \"es\", \"value\": \"Una caracter\\u00edstica opcional de PCI MSI llamada \\\"Mensaje m\\u00faltiple\\\" permite que un dispositivo utilice m\\u00faltiples vectores de interrupci\\u00f3n consecutivos. A diferencia de MSI-X, la configuraci\\u00f3n de estos vectores consecutivos debe realizarse de una sola vez. En este manejo se podr\\u00eda tomar una ruta de error en diferentes situaciones, con o sin un bloqueo particular mantenido. Esta ruta de error libera incorrectamente el bloqueo incluso cuando no est\\u00e1 retenido actualmente.\"}]",
      "id": "CVE-2024-31143",
      "lastModified": "2024-11-21T09:12:55.220",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.6, \"impactScore\": 5.9}]}",
      "published": "2024-07-18T14:15:04.673",
      "references": "[{\"url\": \"https://xenbits.xenproject.org/xsa/advisory-458.html\", \"source\": \"security@xen.org\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/07/16/3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://xenbits.xenproject.org/xsa/advisory-458.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security@xen.org",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-832\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-31143\",\"sourceIdentifier\":\"security@xen.org\",\"published\":\"2024-07-18T14:15:04.673\",\"lastModified\":\"2026-06-17T07:27:51.747\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An optional feature of PCI MSI called \\\"Multiple Message\\\" allows a\\ndevice to use multiple consecutive interrupt vectors.  Unlike for MSI-X,\\nthe setting up of these consecutive vectors needs to happen all in one\\ngo.  In this handling an error path could be taken in different\\nsituations, with or without a particular lock held.  This error path\\nwrongly releases the lock even when it is not currently held.\\n\"},{\"lang\":\"es\",\"value\":\"Una caracter\u00edstica opcional de PCI MSI llamada \\\"Mensaje m\u00faltiple\\\" permite que un dispositivo utilice m\u00faltiples vectores de interrupci\u00f3n consecutivos. A diferencia de MSI-X, la configuraci\u00f3n de estos vectores consecutivos debe realizarse de una sola vez. En este manejo se podr\u00eda tomar una ruta de error en diferentes situaciones, con o sin un bloqueo particular mantenido. Esta ruta de error libera incorrectamente el bloqueo incluso cuando no est\u00e1 retenido actualmente.\"}],\"affected\":[{\"source\":\"security@xen.org\",\"affectedData\":[{\"vendor\":\"Xen\",\"product\":\"Xen\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"consult Xen advisory XSA-458\",\"status\":\"unknown\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"xen\",\"product\":\"xen\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"4.4\",\"lessThan\":\"4.16\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-08-21T13:31:44.467773Z\",\"id\":\"CVE-2024-31143\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-832\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*\",\"versionStartIncluding\":\"4.4.0\",\"matchCriteriaId\":\"7AEA7E1D-EA69-44B6-B2E4-4E955D95E276\"}]}]}],\"references\":[{\"url\":\"https://xenbits.xenproject.org/xsa/advisory-458.html\",\"source\":\"security@xen.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/07/16/3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://xenbits.xen.org/xsa/advisory-458.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://xenbits.xenproject.org/xsa/advisory-458.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-11-21T14:36:59+00:00",
      "cve": "CVE-2024-31143",
      "id": "CVE-2024-31143",
      "initial_release_date": "2024-07-18T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "xen: double unlock in x86 guest IRQ handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-31143.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-11T16:44:46Z",
      "cve": "CVE-2024-31143",
      "id": "CVE-2024-31143",
      "initial_release_date": "2024-07-17T03:42:53Z",
      "product_status:known_affected": "358",
      "product_status:recommended": "158",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-31143",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-31143.json",
      "version": "43"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://xenbits.xenproject.org/xsa/advisory-458.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/07/16/3\"}, {\"url\": \"http://xenbits.xen.org/xsa/advisory-458.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-04-26T20:03:16.232Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-31143\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-21T13:31:44.467773Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*\"], \"vendor\": \"xen\", \"product\": \"xen\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.4\", \"lessThan\": \"4.16\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-832\", \"description\": \"CWE-832 Unlock of a Resource that is not Locked\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-21T13:38:41.707Z\"}}], \"cna\": {\"title\": \"double unlock in x86 guest IRQ handling\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"This issue was discovered by Jan Beulich of SUSE.\\n\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"Denial of Service (DoS) affecting the entire host, crashes, information\\nleaks, or elevation of privilege all cannot be ruled out.\\n\"}]}], \"affected\": [{\"vendor\": \"Xen\", \"product\": \"Xen\", \"versions\": [{\"status\": \"unknown\", \"version\": \"consult Xen advisory XSA-458\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2024-07-16T11:59:00.000Z\", \"references\": [{\"url\": \"https://xenbits.xenproject.org/xsa/advisory-458.html\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Not passing through multi-vector MSI capable devices to x86 guests will\\navoid the vulnerability.\\n\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"An optional feature of PCI MSI called \\\"Multiple Message\\\" allows a\\ndevice to use multiple consecutive interrupt vectors.  Unlike for MSI-X,\\nthe setting up of these consecutive vectors needs to happen all in one\\ngo.  In this handling an error path could be taken in different\\nsituations, with or without a particular lock held.  This error path\\nwrongly releases the lock even when it is not currently held.\\n\"}], \"configurations\": [{\"lang\": \"en\", \"value\": \"Xen versions 4.4 and newer are vulnerable.  Xen versions 4.3 and older\\nare not vulnerable.\\n\\nOnly x86 guest which have a multi-vector MSI capable device passed\\nthrough to them can leverage the vulnerability.\\n\"}], \"providerMetadata\": {\"orgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"shortName\": \"XEN\", \"dateUpdated\": \"2024-07-18T13:31:31.244Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-31143\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-26T20:03:16.232Z\", \"dateReserved\": \"2024-03-28T18:14:12.892Z\", \"assignerOrgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"datePublished\": \"2024-07-18T13:31:31.244Z\", \"assignerShortName\": \"XEN\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.