Vulnerability Details : CVE-2024-27437
In the Linux kernel, the following vulnerability has been resolved:
vfio/pci: Disable auto-enable of exclusive INTx IRQ
Currently for devices requiring masking at the irqchip for INTx, ie.
devices without DisINTx support, the IRQ is enabled in request_irq()
and subsequently disabled as necessary to align with the masked status
flag. This presents a window where the interrupt could fire between
these events, resulting in the IRQ incrementing the disable depth twice.
This would be unrecoverable for a user since the masked flag prevents
nested enables through vfio.
Instead, invert the logic using IRQF_NO_AUTOEN such that exclusive INTx
is never auto-enabled, then unmask as required.
Products affected by CVE-2024-27437
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2024-27437
0.01%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 2 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2024-27437
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST | 2025-03-27 |
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
N/A
|
N/A
|
RedHat-CVE-2024-27437 | 2024-04-05 |
References for CVE-2024-27437
-
https://git.kernel.org/stable/c/3b3491ad0f80d913e7d255941d4470f4a4d9bfda
vfio/pci: Disable auto-enable of exclusive INTx IRQ - kernel/git/stable/linux.git - Linux kernel stable treePatch
-
https://git.kernel.org/stable/c/561d5e1998d58b54ce2bbbb3e843b669aa0b3db5
vfio/pci: Disable auto-enable of exclusive INTx IRQ - kernel/git/stable/linux.git - Linux kernel stable treePatch
-
https://git.kernel.org/stable/c/26389925d6c2126fb777821a0a983adca7ee6351
vfio/pci: Disable auto-enable of exclusive INTx IRQ - kernel/git/stable/linux.git - Linux kernel stable treePatch
-
https://git.kernel.org/stable/c/fe9a7082684eb059b925c535682e68c34d487d43
vfio/pci: Disable auto-enable of exclusive INTx IRQ - kernel/git/stable/linux.git - Linux kernel stable treePatch
-
https://git.kernel.org/stable/c/b7a2f0955ffceffadfe098b40b50307431f45438
vfio/pci: Disable auto-enable of exclusive INTx IRQ - kernel/git/stable/linux.git - Linux kernel stable treePatch
-
https://git.kernel.org/stable/c/bf0bc84a20e6109ab07d5dc072067bd01eb931ec
vfio/pci: Disable auto-enable of exclusive INTx IRQ - kernel/git/stable/linux.git - Linux kernel stable treePatch
-
https://git.kernel.org/stable/c/2a4a666c45107206605b7b5bc20545f8aabc4fa2
vfio/pci: Disable auto-enable of exclusive INTx IRQ - kernel/git/stable/linux.git - Linux kernel stable treePatch
-
https://git.kernel.org/stable/c/139dfcc4d723ab13469881200c7d80f49d776060
vfio/pci: Disable auto-enable of exclusive INTx IRQ - kernel/git/stable/linux.git - Linux kernel stable treePatch
-
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
[SECURITY] [DLA 3842-1] linux-5.10 security updateMailing List
Jump to