CVE-2024-31145
📋 TL;DR
This CVE describes a vulnerability in Xen hypervisor's memory mapping logic for PCI devices with Reserved Memory Regions (RMRR) or Unity Mapping ranges. When error handling fails during device deactivation, memory mappings may persist, allowing guest VMs unauthorized access to sensitive host memory regions. This affects Xen-based virtualization environments using Intel VT-d or AMD-Vi with PCI passthrough devices.
💻 Affected Systems
- Xen Hypervisor
📦 What is this software?
Xen by Xen
⚠️ Risk & Real-World Impact
Worst Case
Guest VM gains persistent access to host memory regions containing sensitive data (encryption keys, credentials, other VM memory), potentially leading to full host compromise and data exfiltration across all VMs.
Likely Case
Guest VM accesses memory regions intended for platform tasks (legacy USB emulation), potentially causing system instability, data corruption, or information disclosure.
If Mitigated
With proper isolation controls and monitoring, impact limited to specific PCI devices; memory access may be to non-sensitive platform regions.
🎯 Exploit Status
Exploitation requires guest VM with PCI passthrough device access and ability to trigger device deactivation scenarios; specific timing/conditions needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Xen 4.18.1 and later
Vendor Advisory: https://xenbits.xenproject.org/xsa/advisory-460.html
Restart Required: Yes
Instructions:
1. Update Xen to version 4.18.1 or later. 2. Apply patches from Xen Security Advisory XSA-460. 3. Reboot hypervisor host. 4. Verify all guest VMs restart with updated hypervisor.
🔧 Temporary Workarounds
Disable PCI passthrough for affected devices
linuxRemove PCI passthrough configuration for devices using RMRR/Unity Mapping ranges
xl pci-detach <domain-id> <BDF>
virsh nodedev-detach pci_0000_XX_XX_X
Isolate affected devices
allEnsure devices with RMRR/Unity Mapping are not assigned to untrusted guest VMs
🧯 If You Can't Patch
- Isolate PCI passthrough devices to trusted guest VMs only
- Implement strict monitoring for memory access anomalies and device state changes
🔍 How to Verify
Check if Vulnerable:
Check Xen version: 'xl info | grep xen_version' or 'xen-detect'. If version <= 4.18.0 and using PCI passthrough with RMRR/Unity Mapping devices, system is vulnerable.Check Version:
xl info | grep xen_versionVerify Fix Applied:
Verify Xen version is 4.18.1 or later: 'xl info | grep xen_version'. Check no error messages related to RMRR/Unity Mapping in hypervisor logs during device operations.📡 Detection & Monitoring
Log Indicators:
- Hypervisor logs showing RMRR/Unity Mapping errors
- Unexpected memory access patterns in guest VMs
- PCI device state transition failures
Network Indicators:
- Not network-exploitable; no specific network indicators
SIEM Query:
source="xen-hypervisor" AND ("RMRR" OR "Unity Mapping" OR "memory mapping error")