Linux kernel (drivers/vfio/pci): Out-of-bounds read past the ecap_perms table when a tenant touches emulated PCIe

CVSS 7.8CVE-2024-53214Kernel, userspace & hypervisorcurated

Impact

Out-of-bounds read past the ecap_perms table when a tenant touches emulated PCIe extended config space on a device whose first extended capability has to be hidden. That table is the policy that decides which config-space writes vfio lets through to real hardware, so indexing off the end means a tenant's config accesses are policed by whatever kernel bytes follow it - the emulation boundary that keeps a passthrough device inside its assignment.

Who can reach it

A tenant holding the vfio-pci device fd, doing ordinary reads/writes on the device's config-space region. No race, no special ioctl - the only precondition is a passthrough device whose first PCIe extended capability ID is above PCI_EXT_CAP_ID_MAX (an unknown or deliberately hidden capability), which vfio then has to mask by zeroing the ID in place. No host root required.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim controls: audit the extended capability list of the device models you pass through, and drop /dev/vfio device nodes from containers that do not need them.

References

https://git.kernel.org/stable/c/4464e5aa3aa4574063640f1082f7d7e323af8eb4 https://git.kernel.org/stable/c/7d121f66b67921fb3b95e0ea9856bfba53733e91 https://nvd.nist.gov/vuln/detail/CVE-2024-53214

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.