cbcvebase.
CVE-2024-53214
published 2024-12-27

CVE-2024-53214: In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Properly hide first-in-list PCIe extended capability There are cases where a PCIe…

PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.25%
16.3th percentile
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Properly hide first-in-list PCIe extended capability There are cases where a PCIe extended capability should be hidden from the user. For example, an unknown capability (i.e., capability with ID greater than PCI_EXT_CAP_ID_MAX) or a capability that is intentionally chosen to be hidden from the user. Hiding a capability is done by virtualizing and modifying the 'Next Capability Offset' field of the previous capability so it points to the capability after the one that should be hidden. The special case where the first capability in the list should be hidden is handled differently because there is no previous capability that can be modified. In this case, the capability ID and version are zeroed while leaving the next pointer intact. This hides the capability and leaves an anchor for the rest of the capability list. However, today, hiding the first capability in the list is not done properly if the capability is unknown, as struct vfio_pci_core_device->pci_config_map is set to the capability ID during initialization but the capability ID is not properly checked later when used in vfio_config_do_rw(). This leads to the following warning [1] and to an out-of-bounds access to ecap_perms array. Fix it by checking cap_id in vfio_config_do_rw(), and if it is greater than PCI_EXT_CAP_ID_MAX, use an alternative struct perm_bits for direct read only access instead of the ecap_perms array. Note that this is safe since the above is the only case where cap_id can exceed PCI_EXT_CAP_ID_MAX (except for the special capabilities, which are already checked before). [1] WARNING: CPU: 118 PID: 5329 at drivers/vfio/pci/vfio_pci_config.c:1900 vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] CPU: 118 UID: 0 PID: 5329 Comm: simx-qemu-syste Not tainted 6.12.0+ #1 (snip) Call Trace: ? show_regs+0x69/0x80 ? __warn+0x8d/0x140 ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] ? report_bug+0x18f/0x1a0 ? handle_bug

Affected

28 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.123-1 (bookworm)linux 6.1.123-1 (bookworm)
debianlinux-6.1< linux 6.1.123-1 (bookworm)linux 6.1.123-1 (bookworm)
linuxlinux
linuxlinux>= 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 < 4464e5aa3aa4574063640f1082f7d7e323af8eb44464e5aa3aa4574063640f1082f7d7e323af8eb4
linuxlinux>= 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 < 7d121f66b67921fb3b95e0ea9856bfba53733e917d121f66b67921fb3b95e0ea9856bfba53733e91
linuxlinux>= 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 < 0918f5643fc6c3f7801f4a22397d2cc09ba992070918f5643fc6c3f7801f4a22397d2cc09ba99207
linuxlinux>= 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 < 9567bd34aa3b986736c290c5bcba47e0182ac47a9567bd34aa3b986736c290c5bcba47e0182ac47a
linuxlinux>= 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 < 6c6502d944168cbd7e03a4a08ad6488f78d734856c6502d944168cbd7e03a4a08ad6488f78d73485
linuxlinux>= 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 < 06f2fcf49854ad05a09d09e0dbee6544fff0469506f2fcf49854ad05a09d09e0dbee6544fff04695
linuxlinux>= 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 < 949bee8065a85a5c6607c624dc05b5bc17119699949bee8065a85a5c6607c624dc05b5bc17119699
linuxlinux>= 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 < 1ef195178fb552478eb2587df4ad3be14ef765071ef195178fb552478eb2587df4ad3be14ef76507
linuxlinux>= 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 < fe4bf8d0b6716a423b16495d55b35d3fe515905dfe4bf8d0b6716a423b16495d55b35d3fe515905d
linuxlinux_kernel>= 0 < 5.10.234-15.10.234-1
linuxlinux_kernel>= 0 < 6.1.123-16.1.123-1
linuxlinux_kernel>= 0 < 6.12.3-16.12.3-1
linuxlinux_kernel>= 0 < 6.12.3-16.12.3-1
linuxlinux_kernel>= 0 < 5.4.0-211.2315.4.0-211.231
linuxlinux_kernel>= 0 < 5.15.0-135.1465.15.0-135.146
linuxlinux_kernel>= 0 < 6.8.0-58.606.8.0-58.60
linuxlinux_kernel>= 0 < 6.11.0-18.186.11.0-18.18
linuxlinux_kernel>= 3.6 < 4.19.3254.19.325
linuxlinux_kernel>= 4.20 < 5.4.2875.4.287
linuxlinux_kernel>= 5.11 < 5.15.1745.15.174
linuxlinux_kernel>= 5.16 < 6.1.1206.1.120
linuxlinux_kernel>= 5.5 < 5.10.2315.10.231

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.