PT-2024-29171 · Linux+6 · Linux Kernel+6
Breno Leitao
·
Published
2024-05-10
·
Updated
2025-05-28
·
CVE-2024-40953
CVSS v3.1
4.7
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A data race vulnerability has been resolved in the Linux kernel's KVM module. The issue occurred in the
kvm vcpu on spin() function, where a data race on last boosted vcpu could potentially allow KVM to attempt to get a vCPU using an out-of-bounds index. This could happen if the compiler tears the stores, and the write is split into multiple 8-bit stores, paired with a 32-bit load on a VM with 257 vCPUs. The vulnerability was detected by KCSAN.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Out of bounds Read
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu