Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-53214— vfio/pci: Properly hide first-in-list PCIe extended capability

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于vfio/pci模块中未正确隐藏列表中的第一个PCIe扩展能力。

CVSS 7.8 · High EPSS 0.26% · P16

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153< 4464e5aa3aa4574063640f1082f7d7e323af8eb4 affected
89e1f7d4c66d85f42c3d52ea3866eb10cadf6153< 7d121f66b67921fb3b95e0ea9856bfba53733e91 affected
89e1f7d4c66d85f42c3d52ea3866eb10cadf6153< 0918f5643fc6c3f7801f4a22397d2cc09ba99207 affected
89e1f7d4c66d85f42c3d52ea3866eb10cadf6153< 9567bd34aa3b986736c290c5bcba47e0182ac47a affected
89e1f7d4c66d85f42c3d52ea3866eb10cadf6153< 6c6502d944168cbd7e03a4a08ad6488f78d73485 affected
89e1f7d4c66d85f42c3d52ea3866eb10cadf6153< 06f2fcf49854ad05a09d09e0dbee6544fff04695 affected
89e1f7d4c66d85f42c3d52ea3866eb10cadf6153< 949bee8065a85a5c6607c624dc05b5bc17119699 affected
89e1f7d4c66d85f42c3d52ea3866eb10cadf6153< 1ef195178fb552478eb2587df4ad3be14ef76507 affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-53214

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
vfio/pci: Properly hide first-in-list PCIe extended capability
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Properly hide first-in-list PCIe extended capability There are cases where a PCIe extended capability should be hidden from the user. For example, an unknown capability (i.e., capability with ID greater than PCI_EXT_CAP_ID_MAX) or a capability that is intentionally chosen to be hidden from the user. Hiding a capability is done by virtualizing and modifying the 'Next Capability Offset' field of the previous capability so it points to the capability after the one that should be hidden. The special case where the first capability in the list should be hidden is handled differently because there is no previous capability that can be modified. In this case, the capability ID and version are zeroed while leaving the next pointer intact. This hides the capability and leaves an anchor for the rest of the capability list. However, today, hiding the first capability in the list is not done properly if the capability is unknown, as struct vfio_pci_core_device->pci_config_map is set to the capability ID during initialization but the capability ID is not properly checked later when used in vfio_config_do_rw(). This leads to the following warning [1] and to an out-of-bounds access to ecap_perms array. Fix it by checking cap_id in vfio_config_do_rw(), and if it is greater than PCI_EXT_CAP_ID_MAX, use an alternative struct perm_bits for direct read only access instead of the ecap_perms array. Note that this is safe since the above is the only case where cap_id can exceed PCI_EXT_CAP_ID_MAX (except for the special capabilities, which are already checked before). [1] WARNING: CPU: 118 PID: 5329 at drivers/vfio/pci/vfio_pci_config.c:1900 vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] CPU: 118 UID: 0 PID: 5329 Comm: simx-qemu-syste Not tainted 6.12.0+ #1 (snip) Call Trace: <TASK> ? show_regs+0x69/0x80 ? __warn+0x8d/0x140 ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] ? report_bug+0x18f/0x1a0 ? handle_bug+0x63/0xa0 ? exc_invalid_op+0x19/0x70 ? asm_exc_invalid_op+0x1b/0x20 ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] ? vfio_pci_config_rw+0x244/0x430 [vfio_pci_core] vfio_pci_rw+0x101/0x1b0 [vfio_pci_core] vfio_pci_core_read+0x1d/0x30 [vfio_pci_core] vfio_device_fops_read+0x27/0x40 [vfio] vfs_read+0xbd/0x340 ? vfio_device_fops_unl_ioctl+0xbb/0x740 [vfio] ? __rseq_handle_notify_resume+0xa4/0x4b0 __x64_sys_pread64+0x96/0xc0 x64_sys_call+0x1c3d/0x20d0 do_syscall_64+0x4d/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于vfio/pci模块中未正确隐藏列表中的第一个PCIe扩展能力。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 ~ 4464e5aa3aa4574063640f1082f7d7e323af8eb4 -
Linux Linux 3.6 -

II. Public POCs for CVE-2024-53214

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-53214

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-53214 (9)

Same Patch Batch · Linux · 2024-12-27 · 221 CVEs total

CVE-2024-53186 9.8 CRITICAL ksmbd: fix use-after-free in SMB request handling
CVE-2024-53179 9.8 CRITICAL smb: client: fix use-after-free of signing key
CVE-2024-53169 9.8 CRITICAL nvme-fabrics: fix kernel crash while shutting down controller
CVE-2024-56645 9.8 CRITICAL can: j1939: j1939_session_new(): fix skb reference counting
CVE-2024-53209 9.8 CRITICAL bnxt_en: Fix receive ring space parameters when XDP is active
CVE-2024-56656 9.8 CRITICAL bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips
CVE-2024-53177 9.8 CRITICAL smb: prevent use-after-free due to open_cached_dir error paths
CVE-2024-53206 9.8 CRITICAL tcp: Fix use-after-free of nreq in reqsk_timer_handler().
CVE-2024-56640 9.8 CRITICAL net/smc: fix LGR and link use-after-free issue
CVE-2024-53176 9.8 CRITICAL smb: During unmount, ensure all cached dir instances drop their dentry
CVE-2024-56591 8.8 HIGH Bluetooth: hci_conn: Use disable_delayed_work_sync
CVE-2024-56626 8.8 HIGH ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
CVE-2024-56669 8.8 HIGH iommu/vt-d: Remove cache tags before disabling ATS
CVE-2024-53237 8.8 HIGH Bluetooth: fix use-after-free in device_for_each_child()
CVE-2024-53224 8.8 HIGH RDMA/mlx5: Move events notifier registration to be after device registration
CVE-2024-56653 8.8 HIGH Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
CVE-2024-56651 8.8 HIGH can: hi311x: hi3110_can_ist(): fix potential use-after-free
CVE-2024-56627 8.1 HIGH ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
CVE-2024-56538 7.8 HIGH drm: zynqmp_kms: Unplug DRM device before removal
CVE-2024-56624 7.8 HIGH iommufd: Fix out_fput in iommufd_fault_alloc()

Showing top 20 of 221 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-53214

No comments yet

Leave a comment