Vulnerability · Published Sep 25, 2024 · Assigned by XEN
CVE-2024-31146PCI device pass-through with shared resources
High 7.5
In plain English
A high-severity uncontrolled resource consumption in Xen from Xen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When multiple devices share resources and one of them is to be passed through to a guest, security of the entire system and of respective guests individually cannot really be guaranteed without knowing internals of any of the involved guests. Therefore such a configuration cannot really be security-supported, yet making that explicit was so far missing. Resources the sharing of which is known to be problematic include, but are not limited to - - PCI Base Address Registers (BARs) of multiple devices mapping to the same page (4k on x86), - - INTx lines.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | xen | 4.17.5+23-ga4e5191dc0-1 | DEBIAN-CVE-2024-31146 |
| Debian:12 | xen | 4.17.5+23-ga4e5191dc0-1 | DSA-5836-1 |
| Debian:13 | xen | 4.19.1-1 | DEBIAN-CVE-2024-31146 |
| Debian:14 | xen | 4.19.1-1 | DEBIAN-CVE-2024-31146 |
| Ubuntu:22.04:LTS | xen | no fix listed | UBUNTU-CVE-2024-31146 |
| Ubuntu:24.04:LTS | xen | no fix listed | UBUNTU-CVE-2024-31146 |
| Ubuntu:25.10 | xen | no fix listed | UBUNTU-CVE-2024-31146 |
| Ubuntu:26.04:LTS | xen | no fix listed | UBUNTU-CVE-2024-31146 |
| Ubuntu:26.10 | xen | no fix listed | UBUNTU-CVE-2024-31146 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H