CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability
In the Linux kernel, the following vulnerability has been resolved:
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 6.12.111-1Fixed in 7.2.9-1Fixed in 7.2.10-1 - Compensating control
In vfio_config_do_rw(), check whether cap_id is greater than PCI_EXT_CAP_ID_MAX; for such capabilities, use an alternative struct perm_bits for direct read-only access instead of indexing the ecap_perms array.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53214?
CVE-2024-53214 has a severity rating that indicates a moderate risk, primarily affecting the visibility of certain PCIe extended capabilities.
How do I fix CVE-2024-53214?
To mitigate CVE-2024-53214, ensure you update the Linux Kernel to version 6.12.0 or later, where the vulnerability has been resolved.
What systems are affected by CVE-2024-53214?
CVE-2024-53214 affects the Linux Kernel starting from version 6.12.0 and applies to systems utilizing vfio/pci.
What potential impact does CVE-2024-53214 have?
CVE-2024-53214 may allow unauthorized information exposure regarding PCIe extended capabilities, leading to confusion or exploitation scenarios.
Is CVE-2024-53214 being actively exploited?
As of now, there is no public indication that CVE-2024-53214 is being actively exploited in the wild.