CVE-2024-31146: PCI device pass-through with shared resources
First published: Wed Aug 14 2024(Updated: )
When multiple devices share resources and one of them is to be passed through to a guest, security of the entire system and of respective guests individually cannot really be guaranteed without knowing internals of any of the involved guests. Therefore such a configuration cannot really be security-supported, yet making that explicit was so far missing. Resources the sharing of which is known to be problematic include, but are not limited to - - PCI Base Address Registers (BARs) of multiple devices mapping to the same page (4k on x86), - - INTx lines.
Credit: security@xen.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xen Hypervisor |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-31146?
The severity of CVE-2024-31146 is high due to the potential risks associated with resource sharing among multiple devices.
How do I fix CVE-2024-31146?
To fix CVE-2024-31146, ensure proper isolation of devices and review resource sharing configurations in the Xen Hypervisor.
What systems are affected by CVE-2024-31146?
CVE-2024-31146 specifically affects the Xen Hypervisor when multiple devices share resources.
What types of configurations are vulnerable to CVE-2024-31146?
Configurations that allow passing through shared resources to guests without adequate isolation are vulnerable to CVE-2024-31146.
What are the possible impacts of CVE-2024-31146?
The possible impacts of CVE-2024-31146 include loss of security and potential data breaches across shared guest environments.
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-31146
- agent/first-publish-date
- agent/title
- agent/references
- agent/type
- agent/description
- agent/author
- agent/severity
- agent/weakness
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/trending
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/xen
- canonical/xen hypervisor