CVE-2024-38610 (GCVE-0-2024-38610)

Vulnerability from cvelistv5 – Published: 2024-06-19 13:56 – Updated: 2026-08-05 11:33
VLAI
Title
drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
Summary
In the Linux kernel, the following vulnerability has been resolved: drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() Patch series "mm: follow_pte() improvements and acrn follow_pte() fixes". Patch #1 fixes a bunch of issues I spotted in the acrn driver. It compiles, that's all I know. I'll appreciate some review and testing from acrn folks. Patch #2+#3 improve follow_pte(), passing a VMA instead of the MM, adding more sanity checks, and improving the documentation. Gave it a quick test on x86-64 using VM_PAT that ends up using follow_pte(). This patch (of 3): We currently miss handling various cases, resulting in a dangerous follow_pte() (previously follow_pfn()) usage. (1) We're not checking PTE write permissions. Maybe we should simply always require pte_write() like we do for pin_user_pages_fast(FOLL_WRITE)? Hard to tell, so let's check for ACRN_MEM_ACCESS_WRITE for now. (2) We're not rejecting refcounted pages. As we are not using MMU notifiers, messing with refcounted pages is dangerous and can result in use-after-free. Let's make sure to reject them. (3) We are only looking at the first PTE of a bigger range. We only lookup a single PTE, but memmap->len may span a larger area. Let's loop over all involved PTEs and make sure the PFN range is actually contiguous. Reject everything else: it couldn't have worked either way, and rather made use access PFNs we shouldn't be accessing.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b9c43aa0b18da5619aac347d54cb67fe30d1f884 , < 5c6705aa47b5b78d7ad36fea832bb69caa5bf49a (git)
Affected: 8a6e85f75a83d16a71077e41f2720c691f432002 , < afeb0e69627695f759fc73c39c1640dbf8649b32 (git)
Affected: 8a6e85f75a83d16a71077e41f2720c691f432002 , < e873f36ec890bece26ecce850e969917bceebbb6 (git)
Affected: 8a6e85f75a83d16a71077e41f2720c691f432002 , < 4c4ba3cf3a15ccfbaf787d0296fa42cdb00da9b4 (git)
Affected: 8a6e85f75a83d16a71077e41f2720c691f432002 , < 2c8d6e24930b8ef7d4a81787627c559ae0e0d3bb (git)
Affected: 8a6e85f75a83d16a71077e41f2720c691f432002 , < 3d6586008f7b638f91f3332602592caa8b00b559 (git)
Affected: 149d5fb7e0124c3763e92edd1fde19417f4d2d09 (git)
Affected: 02098ac42b7ff055ec72cd083ee1eb0a23481a19 (git)
Affected: 5.15.33 , < 5.15.161 (semver)
Affected: 5.16.19 , < 5.17 (semver)
Affected: 5.17.2 , < 5.18 (semver)
Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 5.15.161 , ≤ 5.15.* (semver)
Unaffected: 6.1.93 , ≤ 6.1.* (semver)
Unaffected: 6.6.33 , ≤ 6.6.* (semver)
Unaffected: 6.8.12 , ≤ 6.8.* (semver)
Unaffected: 6.9.3 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38610",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-24T18:14:59.732296Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-24T18:15:07.284Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:25.993Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5c6705aa47b5b78d7ad36fea832bb69caa5bf49a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/afeb0e69627695f759fc73c39c1640dbf8649b32"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e873f36ec890bece26ecce850e969917bceebbb6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4c4ba3cf3a15ccfbaf787d0296fa42cdb00da9b4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2c8d6e24930b8ef7d4a81787627c559ae0e0d3bb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3d6586008f7b638f91f3332602592caa8b00b559"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/virt/acrn/mm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5c6705aa47b5b78d7ad36fea832bb69caa5bf49a",
              "status": "affected",
              "version": "b9c43aa0b18da5619aac347d54cb67fe30d1f884",
              "versionType": "git"
            },
            {
              "lessThan": "afeb0e69627695f759fc73c39c1640dbf8649b32",
              "status": "affected",
              "version": "8a6e85f75a83d16a71077e41f2720c691f432002",
              "versionType": "git"
            },
            {
              "lessThan": "e873f36ec890bece26ecce850e969917bceebbb6",
              "status": "affected",
              "version": "8a6e85f75a83d16a71077e41f2720c691f432002",
              "versionType": "git"
            },
            {
              "lessThan": "4c4ba3cf3a15ccfbaf787d0296fa42cdb00da9b4",
              "status": "affected",
              "version": "8a6e85f75a83d16a71077e41f2720c691f432002",
              "versionType": "git"
            },
            {
              "lessThan": "2c8d6e24930b8ef7d4a81787627c559ae0e0d3bb",
              "status": "affected",
              "version": "8a6e85f75a83d16a71077e41f2720c691f432002",
              "versionType": "git"
            },
            {
              "lessThan": "3d6586008f7b638f91f3332602592caa8b00b559",
              "status": "affected",
              "version": "8a6e85f75a83d16a71077e41f2720c691f432002",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "149d5fb7e0124c3763e92edd1fde19417f4d2d09",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "02098ac42b7ff055ec72cd083ee1eb0a23481a19",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.161",
              "status": "affected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThan": "5.17",
              "status": "affected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThan": "5.18",
              "status": "affected",
              "version": "5.17.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/virt/acrn/mm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.161",
                  "versionStartIncluding": "5.15.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.16.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.17.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()\n\nPatch series \"mm: follow_pte() improvements and acrn follow_pte() fixes\".\n\nPatch #1 fixes a bunch of issues I spotted in the acrn driver.  It\ncompiles, that\u0027s all I know.  I\u0027ll appreciate some review and testing from\nacrn folks.\n\nPatch #2+#3 improve follow_pte(), passing a VMA instead of the MM, adding\nmore sanity checks, and improving the documentation.  Gave it a quick test\non x86-64 using VM_PAT that ends up using follow_pte().\n\n\nThis patch (of 3):\n\nWe currently miss handling various cases, resulting in a dangerous\nfollow_pte() (previously follow_pfn()) usage.\n\n(1) We\u0027re not checking PTE write permissions.\n\nMaybe we should simply always require pte_write() like we do for\npin_user_pages_fast(FOLL_WRITE)? Hard to tell, so let\u0027s check for\nACRN_MEM_ACCESS_WRITE for now.\n\n(2) We\u0027re not rejecting refcounted pages.\n\nAs we are not using MMU notifiers, messing with refcounted pages is\ndangerous and can result in use-after-free. Let\u0027s make sure to reject them.\n\n(3) We are only looking at the first PTE of a bigger range.\n\nWe only lookup a single PTE, but memmap-\u003elen may span a larger area.\nLet\u0027s loop over all involved PTEs and make sure the PFN range is\nactually contiguous. Reject everything else: it couldn\u0027t have worked\neither way, and rather made use access PFNs we shouldn\u0027t be accessing."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached only through `ioctl(ACRN_IOCTL_SET_MEMSEG)` on the `/dev/acrn_hsm` misc device from a local process in the ACRN Service VM. No network or adjacent-network protocol handler reaches `acrn_vm_ram_map()`.\nAC:L - The attacker fully controls both halves of the trigger: it chooses which file to `mmap()` to create the VM_PFNMAP VMA (read-only mapping, refcounted-page-backed VMA, or a VMA whose PFNs are non-contiguous) and supplies `vma_base`/`len`/`attr` directly to the ioctl. There is no race, no timing window, and no dependence on memory layout the attacker cannot influence \u2014 the single-PTE lookup and the missing `pte_write()` check fail identically on every attempt.\nPR:L - `acrn_dev_ioctl()` contains no `capable()` or `CAP_*` gate at all, so the only barrier is the permission bits on `/dev/acrn_hsm`; like `/dev/kvm`, this HSM node is commonly made group-accessible to the deprivileged device-model account in ACRN Service VM deployments, putting the full `CREATE_VM` + `SET_MEMSEG` sequence in reach of an ordinary local user.\nUI:N - The attacker performs the entire sequence itself \u2014 open the device, create a VM, mmap a PFNMAP region, issue the ioctl. No victim has to mount, open, click, or otherwise act.\nS:U - The resources actually compromised are host physical pages and kernel objects belonging to the same Linux kernel that contains the vulnerable driver, and the attacker already owns the User VM it maps them into, so the gain is a conventional local kernel privilege escalation rather than a crossing into a different security authority.\nC:H - Because only the first PTE is resolved and the rest of `memmap-\u003elen` is mapped as `PFN_PHYS(pfn)+i`, the attacker\u0027s guest receives EPT read access to host physical pages entirely unrelated to the VMA, and the unrejected refcounted pages remain readable after being freed and reallocated to other kernel objects \u2014 an arbitrary host-memory disclosure primitive.\nI:H - The missing `pte_write()` check lets a read-only host PTE be published to the guest with `ACRN_MEM_ACCESS_WRITE`, and the unbounded PFN range plus the use-after-free on refcounted pages give the guest write access to arbitrary host physical memory and to freed-then-reallocated slab/page contents, which is a direct path to kernel control-flow hijacking.\nA:H - Writing through stale EPT mappings of freed refcounted pages, or into host physical pages that were never part of the mapping, corrupts live kernel data structures and reliably produces oopses and panics of the Service VM host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:33:09.136Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5c6705aa47b5b78d7ad36fea832bb69caa5bf49a"
        },
        {
          "url": "https://git.kernel.org/stable/c/afeb0e69627695f759fc73c39c1640dbf8649b32"
        },
        {
          "url": "https://git.kernel.org/stable/c/e873f36ec890bece26ecce850e969917bceebbb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c4ba3cf3a15ccfbaf787d0296fa42cdb00da9b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c8d6e24930b8ef7d4a81787627c559ae0e0d3bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d6586008f7b638f91f3332602592caa8b00b559"
        }
      ],
      "title": "drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38610",
    "datePublished": "2024-06-19T13:56:12.083Z",
    "dateReserved": "2024-06-18T19:36:34.942Z",
    "dateUpdated": "2026-08-05T11:33:09.136Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-38610",
      "date": "2026-08-07",
      "epss": "0.00213",
      "percentile": "0.11633"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-38610\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-19T14:15:20.893\",\"lastModified\":\"2026-06-17T07:40:42.570\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()\\n\\nPatch series \\\"mm: follow_pte() improvements and acrn follow_pte() fixes\\\".\\n\\nPatch #1 fixes a bunch of issues I spotted in the acrn driver.  It\\ncompiles, that\u0027s all I know.  I\u0027ll appreciate some review and testing from\\nacrn folks.\\n\\nPatch #2+#3 improve follow_pte(), passing a VMA instead of the MM, adding\\nmore sanity checks, and improving the documentation.  Gave it a quick test\\non x86-64 using VM_PAT that ends up using follow_pte().\\n\\n\\nThis patch (of 3):\\n\\nWe currently miss handling various cases, resulting in a dangerous\\nfollow_pte() (previously follow_pfn()) usage.\\n\\n(1) We\u0027re not checking PTE write permissions.\\n\\nMaybe we should simply always require pte_write() like we do for\\npin_user_pages_fast(FOLL_WRITE)? Hard to tell, so let\u0027s check for\\nACRN_MEM_ACCESS_WRITE for now.\\n\\n(2) We\u0027re not rejecting refcounted pages.\\n\\nAs we are not using MMU notifiers, messing with refcounted pages is\\ndangerous and can result in use-after-free. Let\u0027s make sure to reject them.\\n\\n(3) We are only looking at the first PTE of a bigger range.\\n\\nWe only lookup a single PTE, but memmap-\u003elen may span a larger area.\\nLet\u0027s loop over all involved PTEs and make sure the PFN range is\\nactually contiguous. Reject everything else: it couldn\u0027t have worked\\neither way, and rather made use access PFNs we shouldn\u0027t be accessing.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drivers/virt/acrn: corrige las comprobaciones de PFNMAP PTE en acrn_vm_ram_map() Serie de parches \\\"mm: mejoras en follow_pte() y correcciones en acrn follow_pte()\\\". El parche n.\u00ba 1 soluciona varios problemas que detect\u00e9 en el controlador acrn. Se compila, eso es todo lo que s\u00e9. Apreciar\u00e9 algunas revisiones y pruebas por parte de la gente de acrn. El parche #2+#3 mejora follow_pte(), pasa un VMA en lugar del MM, agrega m\u00e1s controles de cordura y mejora la documentaci\u00f3n. Lo prob\u00e9 r\u00e1pidamente en x86-64 usando VM_PAT y termin\u00f3 usando follow_pte(). Este parche (de 3): Actualmente no manejamos varios casos, lo que resulta en un uso peligroso de follow_pte() (anteriormente follow_pfn()). (1) No estamos verificando los permisos de escritura de PTE. \u00bfQuiz\u00e1s simplemente deber\u00edamos requerir siempre pte_write() como lo hacemos para pin_user_pages_fast(FOLL_WRITE)? Es dif\u00edcil saberlo, as\u00ed que busquemos ACRN_MEM_ACCESS_WRITE por ahora. (2) No rechazamos p\u00e1ginas recontadas. Como no utilizamos notificadores MMU, jugar con p\u00e1ginas descontadas es peligroso y puede resultar en use-after-free. Asegur\u00e9monos de rechazarlos. (3) S\u00f3lo estamos ante el primer PTE de una gama mayor. Solo buscamos una PTE, pero memmap-\u0026gt;len puede abarcar un \u00e1rea m\u00e1s grande. Recorramos todos los PTE involucrados y asegur\u00e9monos de que el rango de PFN sea realmente contiguo. Rechace todo lo dem\u00e1s: no podr\u00eda haber funcionado de ninguna manera, y m\u00e1s bien utiliz\u00f3 PFN de acceso a los que no deber\u00edamos acceder.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/virt/acrn/mm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b9c43aa0b18da5619aac347d54cb67fe30d1f884\",\"lessThan\":\"5c6705aa47b5b78d7ad36fea832bb69caa5bf49a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a6e85f75a83d16a71077e41f2720c691f432002\",\"lessThan\":\"afeb0e69627695f759fc73c39c1640dbf8649b32\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a6e85f75a83d16a71077e41f2720c691f432002\",\"lessThan\":\"e873f36ec890bece26ecce850e969917bceebbb6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a6e85f75a83d16a71077e41f2720c691f432002\",\"lessThan\":\"4c4ba3cf3a15ccfbaf787d0296fa42cdb00da9b4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a6e85f75a83d16a71077e41f2720c691f432002\",\"lessThan\":\"2c8d6e24930b8ef7d4a81787627c559ae0e0d3bb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a6e85f75a83d16a71077e41f2720c691f432002\",\"lessThan\":\"3d6586008f7b638f91f3332602592caa8b00b559\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"149d5fb7e0124c3763e92edd1fde19417f4d2d09\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"02098ac42b7ff055ec72cd083ee1eb0a23481a19\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.15.33\",\"lessThan\":\"5.15.161\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.16.19\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.17.2\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/virt/acrn/mm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.161\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.93\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.33\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.12\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.3\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-24T18:14:59.732296Z\",\"id\":\"CVE-2024-38610\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.33\",\"versionEndExcluding\":\"5.15.161\",\"matchCriteriaId\":\"BD3C8C41-9CAB-4B83-A1AC-EEB09465F80D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16.19\",\"versionEndExcluding\":\"5.17\",\"matchCriteriaId\":\"D4ED89FC-18EE-445F-8FE2-A2B6A5F9BB13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17.2\",\"versionEndExcluding\":\"6.1.93\",\"matchCriteriaId\":\"1BB789B4-E163-4EFD-A7B7-C2425185EEC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.33\",\"matchCriteriaId\":\"FCE796DF-3B50-4DC6-BAE5-95271068FC9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.12\",\"matchCriteriaId\":\"80550309-67AB-4FD1-AC07-3DED5C4F01B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.9.3\",\"matchCriteriaId\":\"E07124C1-19E8-4D21-828D-9932A01D3011\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2c8d6e24930b8ef7d4a81787627c559ae0e0d3bb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3d6586008f7b638f91f3332602592caa8b00b559\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c4ba3cf3a15ccfbaf787d0296fa42cdb00da9b4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5c6705aa47b5b78d7ad36fea832bb69caa5bf49a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/afeb0e69627695f759fc73c39c1640dbf8649b32\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e873f36ec890bece26ecce850e969917bceebbb6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2c8d6e24930b8ef7d4a81787627c559ae0e0d3bb\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3d6586008f7b638f91f3332602592caa8b00b559\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c4ba3cf3a15ccfbaf787d0296fa42cdb00da9b4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5c6705aa47b5b78d7ad36fea832bb69caa5bf49a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/afeb0e69627695f759fc73c39c1640dbf8649b32\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e873f36ec890bece26ecce850e969917bceebbb6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:47:09+00:00",
      "cve": "CVE-2024-38610",
      "id": "CVE-2024-38610",
      "initial_release_date": "2024-06-19T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-38610.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5c6705aa47b5b78d7ad36fea832bb69caa5bf49a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/afeb0e69627695f759fc73c39c1640dbf8649b32\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e873f36ec890bece26ecce850e969917bceebbb6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4c4ba3cf3a15ccfbaf787d0296fa42cdb00da9b4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2c8d6e24930b8ef7d4a81787627c559ae0e0d3bb\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3d6586008f7b638f91f3332602592caa8b00b559\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:12:25.993Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-38610\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-24T18:14:59.732296Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-24T18:15:04.471Z\"}}], \"cna\": {\"title\": \"drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b9c43aa0b18da5619aac347d54cb67fe30d1f884\", \"lessThan\": \"5c6705aa47b5b78d7ad36fea832bb69caa5bf49a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8a6e85f75a83d16a71077e41f2720c691f432002\", \"lessThan\": \"afeb0e69627695f759fc73c39c1640dbf8649b32\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8a6e85f75a83d16a71077e41f2720c691f432002\", \"lessThan\": \"e873f36ec890bece26ecce850e969917bceebbb6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8a6e85f75a83d16a71077e41f2720c691f432002\", \"lessThan\": \"4c4ba3cf3a15ccfbaf787d0296fa42cdb00da9b4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8a6e85f75a83d16a71077e41f2720c691f432002\", \"lessThan\": \"2c8d6e24930b8ef7d4a81787627c559ae0e0d3bb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8a6e85f75a83d16a71077e41f2720c691f432002\", \"lessThan\": \"3d6586008f7b638f91f3332602592caa8b00b559\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"149d5fb7e0124c3763e92edd1fde19417f4d2d09\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"02098ac42b7ff055ec72cd083ee1eb0a23481a19\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.15.33\", \"lessThan\": \"5.15.161\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.16.19\", \"lessThan\": \"5.17\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.17.2\", \"lessThan\": \"5.18\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/virt/acrn/mm.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.161\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/virt/acrn/mm.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5c6705aa47b5b78d7ad36fea832bb69caa5bf49a\"}, {\"url\": \"https://git.kernel.org/stable/c/afeb0e69627695f759fc73c39c1640dbf8649b32\"}, {\"url\": \"https://git.kernel.org/stable/c/e873f36ec890bece26ecce850e969917bceebbb6\"}, {\"url\": \"https://git.kernel.org/stable/c/4c4ba3cf3a15ccfbaf787d0296fa42cdb00da9b4\"}, {\"url\": \"https://git.kernel.org/stable/c/2c8d6e24930b8ef7d4a81787627c559ae0e0d3bb\"}, {\"url\": \"https://git.kernel.org/stable/c/3d6586008f7b638f91f3332602592caa8b00b559\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()\\n\\nPatch series \\\"mm: follow_pte() improvements and acrn follow_pte() fixes\\\".\\n\\nPatch #1 fixes a bunch of issues I spotted in the acrn driver.  It\\ncompiles, that\u0027s all I know.  I\u0027ll appreciate some review and testing from\\nacrn folks.\\n\\nPatch #2+#3 improve follow_pte(), passing a VMA instead of the MM, adding\\nmore sanity checks, and improving the documentation.  Gave it a quick test\\non x86-64 using VM_PAT that ends up using follow_pte().\\n\\n\\nThis patch (of 3):\\n\\nWe currently miss handling various cases, resulting in a dangerous\\nfollow_pte() (previously follow_pfn()) usage.\\n\\n(1) We\u0027re not checking PTE write permissions.\\n\\nMaybe we should simply always require pte_write() like we do for\\npin_user_pages_fast(FOLL_WRITE)? Hard to tell, so let\u0027s check for\\nACRN_MEM_ACCESS_WRITE for now.\\n\\n(2) We\u0027re not rejecting refcounted pages.\\n\\nAs we are not using MMU notifiers, messing with refcounted pages is\\ndangerous and can result in use-after-free. Let\u0027s make sure to reject them.\\n\\n(3) We are only looking at the first PTE of a bigger range.\\n\\nWe only lookup a single PTE, but memmap-\u003elen may span a larger area.\\nLet\u0027s loop over all involved PTEs and make sure the PFN range is\\nactually contiguous. Reject everything else: it couldn\u0027t have worked\\neither way, and rather made use access PFNs we shouldn\u0027t be accessing.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.161\", \"versionStartIncluding\": \"5.15.33\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.93\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.33\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.12\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.3\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.16.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.17.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:49:27.986Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-38610\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:49:27.986Z\", \"dateReserved\": \"2024-06-18T19:36:34.942Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-19T13:56:12.083Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.