CVE-2024-31145: error handling in x86 IOMMU identity mapping
First published: Wed Aug 14 2024(Updated: )
Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. In the logic establishing these mappings, error handling was flawed, resulting in such mappings to potentially remain in place when they should have been removed again. Respective guests would then gain access to memory regions which they aren't supposed to have access to.
Credit: security@xen.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xen XAPI |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-31145?
CVE-2024-31145 has been classified as a medium severity vulnerability due to its potential impact on physical device access.
How do I fix CVE-2024-31145?
To fix CVE-2024-31145, ensure that your system is updated with the latest patches provided by the vendor.
Which versions of Xen are affected by CVE-2024-31145?
CVE-2024-31145 affects certain releases of Xen, specifically those in an unstable development phase.
What type of devices are impacted by CVE-2024-31145?
CVE-2024-31145 impacts certain PCI devices that utilize Reserved Memory Regions and are involved in virtualization.
Is CVE-2024-31145 related to virtualization security?
Yes, CVE-2024-31145 is related to virtualization security as it affects memory mappings in systems using Intel VT-d or AMD-Vi technologies.
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-31145
- agent/first-publish-date
- agent/title
- agent/references
- agent/type
- agent/description
- agent/author
- agent/severity
- agent/weakness
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/trending
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/xen
- canonical/xen xapi