cve-2024-31145
Vulnerability from cvelistv5
Published
2024-09-25 10:31
Modified
2024-09-25 13:29
Severity ?
7.5 (High) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS score ?
0.04% (0.09969)
Summary
Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. In the logic establishing these mappings, error handling was flawed, resulting in such mappings to potentially remain in place when they should have been removed again. Respective guests would then gain access to memory regions which they aren't supposed to have access to.
References
security@xen.orghttps://xenbits.xenproject.org/xsa/advisory-460.html
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/08/14/2
af854a3a-2127-422b-91ae-364da2661108http://xenbits.xen.org/xsa/advisory-460.html
Impacted products
Vendor Product Version
Xen Xen Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-09-25T11:02:50.356Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  url: "http://xenbits.xen.org/xsa/advisory-460.html",
               },
               {
                  url: "http://www.openwall.com/lists/oss-security/2024/08/14/2",
               },
            ],
            title: "CVE Program Container",
         },
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:o:xen:xen:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "xen",
                  vendor: "xen",
                  versions: [
                     {
                        lessThanOrEqual: "*",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "HIGH",
                     attackVector: "LOCAL",
                     availabilityImpact: "HIGH",
                     baseScore: 7.5,
                     baseSeverity: "HIGH",
                     confidentialityImpact: "HIGH",
                     integrityImpact: "HIGH",
                     privilegesRequired: "HIGH",
                     scope: "CHANGED",
                     userInteraction: "NONE",
                     vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2024-31145",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-25T13:27:44.216381Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-400",
                        description: "CWE-400 Uncontrolled Resource Consumption",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-25T13:29:33.308Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "Xen",
               vendor: "Xen",
               versions: [
                  {
                     status: "unknown",
                     version: "consult Xen advisory XSA-460",
                  },
               ],
            },
         ],
         configurations: [
            {
               lang: "en",
               value: "Only x86 systems passing PCI devices with RMRR/Unity regions through to\nguests are potentially affected.\n\nPCI devices listed in a vm.cfg file have error handling which causes `xl\ncreate` to abort and tear down the domain, and is thus believed to be\nsafe.\n\nPCI devices attached using `xl pci-attach` will result in the command\nreturning nonzero, but will not tear down the domain.  VMs which\ncontinue to run after `xl pci-attach` has failed expose the\nvulnerability.\n\nFor x86 Intel hardware, Xen versions 4.0 and later are affected.\n\nFor all x86 hardware, Xen versions having the XSA-378 fixes applied /\nbackported are affected.",
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "This issue was discovered by Teddy Astie of Vates and diagnosed as a\nsecurity issue by Jan Beulich of SUSE.",
            },
         ],
         datePublic: "2024-08-13T12:00:00Z",
         descriptions: [
            {
               lang: "en",
               value: "Certain PCI devices in a system might be assigned Reserved Memory\nRegions (specified via Reserved Memory Region Reporting, \"RMRR\") for\nIntel VT-d or Unity Mapping ranges for AMD-Vi.  These are typically used\nfor platform tasks such as legacy USB emulation.\n\nSince the precise purpose of these regions is unknown, once a device\nassociated with such a region is active, the mappings of these regions\nneed to remain continuouly accessible by the device.  In the logic\nestablishing these mappings, error handling was flawed, resulting in\nsuch mappings to potentially remain in place when they should have been\nremoved again.  Respective guests would then gain access to memory\nregions which they aren't supposed to have access to.",
            },
         ],
         impacts: [
            {
               descriptions: [
                  {
                     lang: "en",
                     value: "The precise impact is system specific.  Denial of Service (DoS)\naffecting the entire host or individual guests, privilege escalation,\nand information leaks cannot be ruled out.",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-09-25T10:31:43.523Z",
            orgId: "23aa2041-22e1-471f-9209-9b7396fa234f",
            shortName: "XEN",
         },
         references: [
            {
               url: "https://xenbits.xenproject.org/xsa/advisory-460.html",
            },
         ],
         title: "error handling in x86 IOMMU identity mapping",
         workarounds: [
            {
               lang: "en",
               value: "Assigning devices using the vm.cfg file for attachment at boot avoids\nthe vulnerability.",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "23aa2041-22e1-471f-9209-9b7396fa234f",
      assignerShortName: "XEN",
      cveId: "CVE-2024-31145",
      datePublished: "2024-09-25T10:31:43.523Z",
      dateReserved: "2024-03-28T18:14:12.893Z",
      dateUpdated: "2024-09-25T13:29:33.308Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      fkie_nvd: {
         descriptions: "[{\"lang\": \"en\", \"value\": \"Certain PCI devices in a system might be assigned Reserved Memory\\nRegions (specified via Reserved Memory Region Reporting, \\\"RMRR\\\") for\\nIntel VT-d or Unity Mapping ranges for AMD-Vi.  These are typically used\\nfor platform tasks such as legacy USB emulation.\\n\\nSince the precise purpose of these regions is unknown, once a device\\nassociated with such a region is active, the mappings of these regions\\nneed to remain continuouly accessible by the device.  In the logic\\nestablishing these mappings, error handling was flawed, resulting in\\nsuch mappings to potentially remain in place when they should have been\\nremoved again.  Respective guests would then gain access to memory\\nregions which they aren't supposed to have access to.\"}, {\"lang\": \"es\", \"value\": \"Ciertos dispositivos PCI de un sistema se les pueden asignar regiones de memoria reservadas (especificadas a trav\\u00e9s de informes de regiones de memoria reservadas, \\\"RMRR\\\") para Intel VT-d o rangos de mapeo de Unity para AMD-Vi. Por lo general, se utilizan para tareas de plataforma como la emulaci\\u00f3n USB heredada. Dado que se desconoce el prop\\u00f3sito preciso de estas regiones, una vez que un dispositivo asociado con dicha regi\\u00f3n est\\u00e1 activo, las asignaciones de estas regiones deben permanecer accesibles continuamente para el dispositivo. En la l\\u00f3gica que establece estas asignaciones, el manejo de errores era defectuoso, lo que result\\u00f3 en que dichas asignaciones potencialmente permanecieran en su lugar cuando deber\\u00edan haberse eliminado nuevamente. Los invitados respectivos obtendr\\u00edan entonces acceso a regiones de memoria a las que se supone que no deber\\u00edan tener acceso.\"}]",
         id: "CVE-2024-31145",
         lastModified: "2024-11-21T09:12:55.410",
         metrics: "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 0.8, \"impactScore\": 6.0}]}",
         published: "2024-09-25T11:15:12.133",
         references: "[{\"url\": \"https://xenbits.xenproject.org/xsa/advisory-460.html\", \"source\": \"security@xen.org\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/08/14/2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://xenbits.xen.org/xsa/advisory-460.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
         sourceIdentifier: "security@xen.org",
         vulnStatus: "Awaiting Analysis",
         weaknesses: "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-400\"}]}]",
      },
      nvd: "{\"cve\":{\"id\":\"CVE-2024-31145\",\"sourceIdentifier\":\"security@xen.org\",\"published\":\"2024-09-25T11:15:12.133\",\"lastModified\":\"2024-11-21T09:12:55.410\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Certain PCI devices in a system might be assigned Reserved Memory\\nRegions (specified via Reserved Memory Region Reporting, \\\"RMRR\\\") for\\nIntel VT-d or Unity Mapping ranges for AMD-Vi.  These are typically used\\nfor platform tasks such as legacy USB emulation.\\n\\nSince the precise purpose of these regions is unknown, once a device\\nassociated with such a region is active, the mappings of these regions\\nneed to remain continuouly accessible by the device.  In the logic\\nestablishing these mappings, error handling was flawed, resulting in\\nsuch mappings to potentially remain in place when they should have been\\nremoved again.  Respective guests would then gain access to memory\\nregions which they aren't supposed to have access to.\"},{\"lang\":\"es\",\"value\":\"Ciertos dispositivos PCI de un sistema se les pueden asignar regiones de memoria reservadas (especificadas a través de informes de regiones de memoria reservadas, \\\"RMRR\\\") para Intel VT-d o rangos de mapeo de Unity para AMD-Vi. Por lo general, se utilizan para tareas de plataforma como la emulación USB heredada. Dado que se desconoce el propósito preciso de estas regiones, una vez que un dispositivo asociado con dicha región está activo, las asignaciones de estas regiones deben permanecer accesibles continuamente para el dispositivo. En la lógica que establece estas asignaciones, el manejo de errores era defectuoso, lo que resultó en que dichas asignaciones potencialmente permanecieran en su lugar cuando deberían haberse eliminado nuevamente. Los invitados respectivos obtendrían entonces acceso a regiones de memoria a las que se supone que no deberían tener acceso.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.8,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"references\":[{\"url\":\"https://xenbits.xenproject.org/xsa/advisory-460.html\",\"source\":\"security@xen.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/08/14/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://xenbits.xen.org/xsa/advisory-460.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://xenbits.xen.org/xsa/advisory-460.html\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/08/14/2\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-09-25T11:02:50.356Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-31145\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-25T13:27:44.216381Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:xen:xen:-:*:*:*:*:*:*:*\"], \"vendor\": \"xen\", \"product\": \"xen\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"*\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400 Uncontrolled Resource Consumption\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-25T13:29:25.367Z\"}}], \"cna\": {\"title\": \"error handling in x86 IOMMU identity mapping\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"This issue was discovered by Teddy Astie of Vates and diagnosed as a\\nsecurity issue by Jan Beulich of SUSE.\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"The precise impact is system specific.  Denial of Service (DoS)\\naffecting the entire host or individual guests, privilege escalation,\\nand information leaks cannot be ruled out.\"}]}], \"affected\": [{\"vendor\": \"Xen\", \"product\": \"Xen\", \"versions\": [{\"status\": \"unknown\", \"version\": \"consult Xen advisory XSA-460\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2024-08-13T12:00:00Z\", \"references\": [{\"url\": \"https://xenbits.xenproject.org/xsa/advisory-460.html\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Assigning devices using the vm.cfg file for attachment at boot avoids\\nthe vulnerability.\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Certain PCI devices in a system might be assigned Reserved Memory\\nRegions (specified via Reserved Memory Region Reporting, \\\"RMRR\\\") for\\nIntel VT-d or Unity Mapping ranges for AMD-Vi.  These are typically used\\nfor platform tasks such as legacy USB emulation.\\n\\nSince the precise purpose of these regions is unknown, once a device\\nassociated with such a region is active, the mappings of these regions\\nneed to remain continuouly accessible by the device.  In the logic\\nestablishing these mappings, error handling was flawed, resulting in\\nsuch mappings to potentially remain in place when they should have been\\nremoved again.  Respective guests would then gain access to memory\\nregions which they aren't supposed to have access to.\"}], \"configurations\": [{\"lang\": \"en\", \"value\": \"Only x86 systems passing PCI devices with RMRR/Unity regions through to\\nguests are potentially affected.\\n\\nPCI devices listed in a vm.cfg file have error handling which causes `xl\\ncreate` to abort and tear down the domain, and is thus believed to be\\nsafe.\\n\\nPCI devices attached using `xl pci-attach` will result in the command\\nreturning nonzero, but will not tear down the domain.  VMs which\\ncontinue to run after `xl pci-attach` has failed expose the\\nvulnerability.\\n\\nFor x86 Intel hardware, Xen versions 4.0 and later are affected.\\n\\nFor all x86 hardware, Xen versions having the XSA-378 fixes applied /\\nbackported are affected.\"}], \"providerMetadata\": {\"orgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"shortName\": \"XEN\", \"dateUpdated\": \"2024-09-25T10:31:43.523Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-31145\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-25T13:29:33.308Z\", \"dateReserved\": \"2024-03-28T18:14:12.893Z\", \"assignerOrgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"datePublished\": \"2024-09-25T10:31:43.523Z\", \"assignerShortName\": \"XEN\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.