CVE-2024-40953 (GCVE-0-2024-40953)
Vulnerability from cvelistv5 – Published: 2024-07-12 12:31 – Updated: 2026-08-05 11:34
VLAI
EPSS
VEX
Title
KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
Use {READ,WRITE}_ONCE() to access kvm->last_boosted_vcpu to ensure the
loads and stores are atomic. In the extremely unlikely scenario the
compiler tears the stores, it's theoretically possible for KVM to attempt
to get a vCPU using an out-of-bounds index, e.g. if the write is split
into multiple 8-bit stores, and is paired with a 32-bit load on a VM with
257 vCPUs:
CPU0 CPU1
last_boosted_vcpu = 0xff;
(last_boosted_vcpu = 0x100)
last_boosted_vcpu[15:8] = 0x01;
i = (last_boosted_vcpu = 0x1ff)
last_boosted_vcpu[7:0] = 0x00;
vcpu = kvm->vcpu_array[0x1ff];
As detected by KCSAN:
BUG: KCSAN: data-race in kvm_vcpu_on_spin [kvm] / kvm_vcpu_on_spin [kvm]
write to 0xffffc90025a92344 of 4 bytes by task 4340 on cpu 16:
kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112) kvm
handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel
vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?
arch/x86/kvm/vmx/vmx.c:6606) kvm_intel
vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm
kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm
kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm
__se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)
__x64_sys_ioctl (fs/ioctl.c:890)
x64_sys_call (arch/x86/entry/syscall_64.c:33)
do_syscall_64 (arch/x86/entry/common.c:?)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
read to 0xffffc90025a92344 of 4 bytes by task 4342 on cpu 4:
kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4069) kvm
handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel
vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?
arch/x86/kvm/vmx/vmx.c:6606) kvm_intel
vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm
kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm
kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm
__se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)
__x64_sys_ioctl (fs/ioctl.c:890)
x64_sys_call (arch/x86/entry/syscall_64.c:33)
do_syscall_64 (arch/x86/entry/common.c:?)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
value changed: 0x00000012 -> 0x00000000
Severity
7.9 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:03 UTC
Assigner
References
10 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
217ece6129f2d3b4fdd18d9e79be9e43d8d14a42 , < 11a772d5376aa6d3e2e69b5b5c585f79b60c0e17
(git)
Affected: 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42 , < 4c141136a28421b78f34969b25a4fa32e06e2180 (git) Affected: 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42 , < 71fbc3af3dacb26c3aa2f30bb3ab05c44d082c84 (git) Affected: 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42 , < 82bd728a06e55f5b5f93d10ce67f4fe7e689853a (git) Affected: 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42 , < 92c77807d938145c7c3350c944ef9f39d7f6017c (git) Affected: 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42 , < a937ef951bba72f48d2402451419d725d70dba20 (git) Affected: 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42 , < 95c8dd79f3a14df96b3820b35b8399bd91b2be60 (git) Affected: 217ece6129f2d3b4fdd18d9e79be9e43d8d14a42 , < 49f683b41f28918df3e51ddc0d928cb2e934ccdb (git) |
guessed | |
| Linux | Linux |
Affected:
2.6.39
Unaffected: 0 , < 2.6.39 (semver) Unaffected: 4.19.323 , ≤ 4.19.* (semver) Unaffected: 5.4.285 , ≤ 5.4.* (semver) Unaffected: 5.10.228 , ≤ 5.10.* (semver) Unaffected: 5.15.169 , ≤ 5.15.* (semver) Unaffected: 6.1.96 , ≤ 6.1.* (semver) Unaffected: 6.6.36 , ≤ 6.6.* (semver) Unaffected: 6.9.7 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-03T21:58:17.097Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/92c77807d938145c7c3350c944ef9f39d7f6017c"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/a937ef951bba72f48d2402451419d725d70dba20"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/95c8dd79f3a14df96b3820b35b8399bd91b2be60"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/49f683b41f28918df3e51ddc0d928cb2e934ccdb"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-40953",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T17:03:52.034893Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T17:34:24.499Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"virt/kvm/kvm_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "11a772d5376aa6d3e2e69b5b5c585f79b60c0e17",
"status": "affected",
"version": "217ece6129f2d3b4fdd18d9e79be9e43d8d14a42",
"versionType": "git"
},
{
"lessThan": "4c141136a28421b78f34969b25a4fa32e06e2180",
"status": "affected",
"version": "217ece6129f2d3b4fdd18d9e79be9e43d8d14a42",
"versionType": "git"
},
{
"lessThan": "71fbc3af3dacb26c3aa2f30bb3ab05c44d082c84",
"status": "affected",
"version": "217ece6129f2d3b4fdd18d9e79be9e43d8d14a42",
"versionType": "git"
},
{
"lessThan": "82bd728a06e55f5b5f93d10ce67f4fe7e689853a",
"status": "affected",
"version": "217ece6129f2d3b4fdd18d9e79be9e43d8d14a42",
"versionType": "git"
},
{
"lessThan": "92c77807d938145c7c3350c944ef9f39d7f6017c",
"status": "affected",
"version": "217ece6129f2d3b4fdd18d9e79be9e43d8d14a42",
"versionType": "git"
},
{
"lessThan": "a937ef951bba72f48d2402451419d725d70dba20",
"status": "affected",
"version": "217ece6129f2d3b4fdd18d9e79be9e43d8d14a42",
"versionType": "git"
},
{
"lessThan": "95c8dd79f3a14df96b3820b35b8399bd91b2be60",
"status": "affected",
"version": "217ece6129f2d3b4fdd18d9e79be9e43d8d14a42",
"versionType": "git"
},
{
"lessThan": "49f683b41f28918df3e51ddc0d928cb2e934ccdb",
"status": "affected",
"version": "217ece6129f2d3b4fdd18d9e79be9e43d8d14a42",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"virt/kvm/kvm_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.39"
},
{
"lessThan": "2.6.39",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.323",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.285",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.228",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.169",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.9.*",
"status": "unaffected",
"version": "6.9.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.10",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.323",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.285",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.228",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.169",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.96",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.36",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.7",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.10",
"versionStartIncluding": "2.6.39",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()\n\nUse {READ,WRITE}_ONCE() to access kvm-\u003elast_boosted_vcpu to ensure the\nloads and stores are atomic. In the extremely unlikely scenario the\ncompiler tears the stores, it\u0027s theoretically possible for KVM to attempt\nto get a vCPU using an out-of-bounds index, e.g. if the write is split\ninto multiple 8-bit stores, and is paired with a 32-bit load on a VM with\n257 vCPUs:\n\n CPU0 CPU1\n last_boosted_vcpu = 0xff;\n\n (last_boosted_vcpu = 0x100)\n last_boosted_vcpu[15:8] = 0x01;\n i = (last_boosted_vcpu = 0x1ff)\n last_boosted_vcpu[7:0] = 0x00;\n\n vcpu = kvm-\u003evcpu_array[0x1ff];\n\nAs detected by KCSAN:\n\n BUG: KCSAN: data-race in kvm_vcpu_on_spin [kvm] / kvm_vcpu_on_spin [kvm]\n\n write to 0xffffc90025a92344 of 4 bytes by task 4340 on cpu 16:\n kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112) kvm\n handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel\n vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?\n\t\t arch/x86/kvm/vmx/vmx.c:6606) kvm_intel\n vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm\n kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm\n kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm\n __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)\n __x64_sys_ioctl (fs/ioctl.c:890)\n x64_sys_call (arch/x86/entry/syscall_64.c:33)\n do_syscall_64 (arch/x86/entry/common.c:?)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\n read to 0xffffc90025a92344 of 4 bytes by task 4342 on cpu 4:\n kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4069) kvm\n handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel\n vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?\n\t\t\tarch/x86/kvm/vmx/vmx.c:6606) kvm_intel\n vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm\n kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm\n kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm\n __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)\n __x64_sys_ioctl (fs/ioctl.c:890)\n x64_sys_call (arch/x86/entry/syscall_64.c:33)\n do_syscall_64 (arch/x86/entry/common.c:?)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\n value changed: 0x00000012 -\u003e 0x00000000"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.9,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is entered only from guest execution of PAUSE/WFE/DIAG-0x44 handled by the host KVM module, or equivalently via the `KVM_RUN` ioctl on `/dev/kvm` as shown in the KCSAN stack trace. There is no network-facing path to `kvm_vcpu_on_spin()`, so the attacker must be running code locally on the host or inside a VM hosted on it.\nAC:L - The attacker controls both sides of the race outright \u2014 a guest simply runs PAUSE spin loops on several vCPUs at once, driving many threads into the unsynchronized read/write of `kvm-\u003elast_boosted_vcpu` with no external precondition. No specific victim state or memory layout the attacker cannot influence is required to hit the racing accesses.\nPR:L - The attacker needs the ability to run code inside a VM on the host (or open `/dev/kvm` locally), which is an unprivileged-user-level capability \u2014 no root or CAP_SYS_ADMIN is required, and PAUSE is executable from guest ring 3. This matches the standard treatment of guest-triggerable KVM host bugs.\nUI:N - Triggering requires only that the attacker\u0027s own guest vCPU threads spin concurrently; no host administrator or other user has to perform any action. The race is hit entirely by the attacker\u0027s own execution.\nS:C - The bug is triggered by unprivileged code inside a guest but the corrupted index and any resulting wild pointer access occur in the host kernel, crossing the VM-to-hypervisor security boundary. A guest compromising host kernel availability/integrity is a scope change.\nC:L - A torn value yields an out-of-bounds vCPU index, causing the host to read a pointer-sized slot past the vCPU array and then dereference it (`vcpu-\u003eready`, `vcpu-\u003epreempted`, `target-\u003epid`), touching host kernel memory outside the intended object. The read value is never returned to the guest and the offset is not attacker-chosen, so this is a limited disclosure rather than an arbitrary read primitive.\nI:L - `kvm_vcpu_eligible_for_directed_yield()` writes `vcpu-\u003espin_loop.dy_eligible` through the same unvalidated pointer, giving a fixed-offset host-kernel write via an out-of-bounds vCPU reference, and the bogus target also perturbs host scheduling through `yield_to()`. The written value and target address are not attacker-controlled, limiting this to bounded corruption rather than a control-flow hijack primitive.\nA:H - Per the upstream changelog, the torn access lets KVM fetch a vCPU with an out-of-bounds index; the resulting NULL or garbage pointer is dereferenced without any validation, oopsing or panicking the host kernel. A guest crashing the hypervisor takes down the host and every other VM on it."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:34:12.855Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/11a772d5376aa6d3e2e69b5b5c585f79b60c0e17"
},
{
"url": "https://git.kernel.org/stable/c/4c141136a28421b78f34969b25a4fa32e06e2180"
},
{
"url": "https://git.kernel.org/stable/c/71fbc3af3dacb26c3aa2f30bb3ab05c44d082c84"
},
{
"url": "https://git.kernel.org/stable/c/82bd728a06e55f5b5f93d10ce67f4fe7e689853a"
},
{
"url": "https://git.kernel.org/stable/c/92c77807d938145c7c3350c944ef9f39d7f6017c"
},
{
"url": "https://git.kernel.org/stable/c/a937ef951bba72f48d2402451419d725d70dba20"
},
{
"url": "https://git.kernel.org/stable/c/95c8dd79f3a14df96b3820b35b8399bd91b2be60"
},
{
"url": "https://git.kernel.org/stable/c/49f683b41f28918df3e51ddc0d928cb2e934ccdb"
}
],
"title": "KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-40953",
"datePublished": "2024-07-12T12:31:56.832Z",
"dateReserved": "2024-07-12T12:17:45.592Z",
"dateUpdated": "2026-08-05T11:34:12.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-40953",
"date": "2026-09-15",
"epss": "0.00197",
"percentile": "0.09603"
},
"fkie_nvd": {
"descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()\\n\\nUse {READ,WRITE}_ONCE() to access kvm-\u003elast_boosted_vcpu to ensure the\\nloads and stores are atomic. In the extremely unlikely scenario the\\ncompiler tears the stores, it\u0027s theoretically possible for KVM to attempt\\nto get a vCPU using an out-of-bounds index, e.g. if the write is split\\ninto multiple 8-bit stores, and is paired with a 32-bit load on a VM with\\n257 vCPUs:\\n\\n CPU0 CPU1\\n last_boosted_vcpu = 0xff;\\n\\n (last_boosted_vcpu = 0x100)\\n last_boosted_vcpu[15:8] = 0x01;\\n i = (last_boosted_vcpu = 0x1ff)\\n last_boosted_vcpu[7:0] = 0x00;\\n\\n vcpu = kvm-\u003evcpu_array[0x1ff];\\n\\nAs detected by KCSAN:\\n\\n BUG: KCSAN: data-race in kvm_vcpu_on_spin [kvm] / kvm_vcpu_on_spin [kvm]\\n\\n write to 0xffffc90025a92344 of 4 bytes by task 4340 on cpu 16:\\n kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112) kvm\\n handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel\\n vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?\\n\\t\\t arch/x86/kvm/vmx/vmx.c:6606) kvm_intel\\n vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm\\n kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm\\n kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm\\n __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)\\n __x64_sys_ioctl (fs/ioctl.c:890)\\n x64_sys_call (arch/x86/entry/syscall_64.c:33)\\n do_syscall_64 (arch/x86/entry/common.c:?)\\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\\n\\n read to 0xffffc90025a92344 of 4 bytes by task 4342 on cpu 4:\\n kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4069) kvm\\n handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel\\n vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?\\n\\t\\t\\tarch/x86/kvm/vmx/vmx.c:6606) kvm_intel\\n vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm\\n kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm\\n kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm\\n __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)\\n __x64_sys_ioctl (fs/ioctl.c:890)\\n x64_sys_call (arch/x86/entry/syscall_64.c:33)\\n do_syscall_64 (arch/x86/entry/common.c:?)\\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\\n\\n value changed: 0x00000012 -\u003e 0x00000000\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: KVM: solucione una ejecuci\\u00f3n de datos en last_boosted_vcpu en kvm_vcpu_on_spin() Utilice {READ,WRITE}_ONCE() para acceder a kvm-\u0026gt;last_boosted_vcpu para garantizar que las cargas y los almacenes sean at\\u00f3micos. En el escenario extremadamente improbable de que el compilador rompa los almacenes, es te\\u00f3ricamente posible que KVM intente obtener una vCPU utilizando un \\u00edndice fuera de los l\\u00edmites, por ejemplo, si la escritura se divide en varios almacenes de 8 bits y se combina con un 32 -carga de bits en una VM con 257 vCPU: CPU0 CPU1 last_boosted_vcpu = 0xff; (last_boosted_vcpu = 0x100) last_boosted_vcpu[15:8] = 0x01; i = (last_boosted_vcpu = 0x1ff) last_boosted_vcpu[7:0] = 0x00; vcpu = kvm-\u0026gt;vcpu_array[0x1ff]; Seg\\u00fan lo detectado por KCSAN: ERROR: KCSAN: ejecuci\\u00f3n de datos en kvm_vcpu_on_spin [kvm] / kvm_vcpu_on_spin [kvm] escribe en 0xffffc90025a92344 de 4 bytes por tarea 4340 en la CPU 16: kvm_vcpu_on_spin (arch/x86/kvm/../../. ./virt/kvm/kvm_main.c:4112) kvm handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:? arch/x86/kvm /vmx/vmx.c:6606) kvm_intel vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c :890) __x64_sys_ioctl (fs/ioctl.c:890) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) Entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64 .S:130) le\\u00eddo en 0xffffc90025a92344 de 4 bytes por la tarea 4342 en la CPU 4: kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4069) kvm handle_pause (arch/ x86/kvm/vmx/vmx.c:5929) kvm_intel vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:? arch/x86/kvm/vmx/vmx.c:6606) kvm_intel vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86 .c:?) kvm kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890) __x64_sys_ioctl (fs/ioctl.c:890) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) Entry_SYSCALL_64_after_hwframe (arch/ x86/entry/entry_64.S:130) valor cambiado: 0x00000012 -\u0026gt; 0x00000000\"}]",
"id": "CVE-2024-40953",
"lastModified": "2024-11-21T09:31:56.280",
"published": "2024-07-12T13:15:17.560",
"references": "[{\"url\": \"https://git.kernel.org/stable/c/11a772d5376aa6d3e2e69b5b5c585f79b60c0e17\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/49f683b41f28918df3e51ddc0d928cb2e934ccdb\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/4c141136a28421b78f34969b25a4fa32e06e2180\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/71fbc3af3dacb26c3aa2f30bb3ab05c44d082c84\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/82bd728a06e55f5b5f93d10ce67f4fe7e689853a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/92c77807d938145c7c3350c944ef9f39d7f6017c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/95c8dd79f3a14df96b3820b35b8399bd91b2be60\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a937ef951bba72f48d2402451419d725d70dba20\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/49f683b41f28918df3e51ddc0d928cb2e934ccdb\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/92c77807d938145c7c3350c944ef9f39d7f6017c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/95c8dd79f3a14df96b3820b35b8399bd91b2be60\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a937ef951bba72f48d2402451419d725d70dba20\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Awaiting Analysis"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-40953\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:17.560\",\"lastModified\":\"2026-08-04T11:19:08.820\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()\\n\\nUse {READ,WRITE}_ONCE() to access kvm-\u003elast_boosted_vcpu to ensure the\\nloads and stores are atomic. In the extremely unlikely scenario the\\ncompiler tears the stores, it\u0027s theoretically possible for KVM to attempt\\nto get a vCPU using an out-of-bounds index, e.g. if the write is split\\ninto multiple 8-bit stores, and is paired with a 32-bit load on a VM with\\n257 vCPUs:\\n\\n CPU0 CPU1\\n last_boosted_vcpu = 0xff;\\n\\n (last_boosted_vcpu = 0x100)\\n last_boosted_vcpu[15:8] = 0x01;\\n i = (last_boosted_vcpu = 0x1ff)\\n last_boosted_vcpu[7:0] = 0x00;\\n\\n vcpu = kvm-\u003evcpu_array[0x1ff];\\n\\nAs detected by KCSAN:\\n\\n BUG: KCSAN: data-race in kvm_vcpu_on_spin [kvm] / kvm_vcpu_on_spin [kvm]\\n\\n write to 0xffffc90025a92344 of 4 bytes by task 4340 on cpu 16:\\n kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112) kvm\\n handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel\\n vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?\\n\\t\\t arch/x86/kvm/vmx/vmx.c:6606) kvm_intel\\n vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm\\n kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm\\n kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm\\n __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)\\n __x64_sys_ioctl (fs/ioctl.c:890)\\n x64_sys_call (arch/x86/entry/syscall_64.c:33)\\n do_syscall_64 (arch/x86/entry/common.c:?)\\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\\n\\n read to 0xffffc90025a92344 of 4 bytes by task 4342 on cpu 4:\\n kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4069) kvm\\n handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel\\n vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?\\n\\t\\t\\tarch/x86/kvm/vmx/vmx.c:6606) kvm_intel\\n vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm\\n kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm\\n kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm\\n __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)\\n __x64_sys_ioctl (fs/ioctl.c:890)\\n x64_sys_call (arch/x86/entry/syscall_64.c:33)\\n do_syscall_64 (arch/x86/entry/common.c:?)\\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\\n\\n value changed: 0x00000012 -\u003e 0x00000000\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: KVM: solucione una ejecuci\u00f3n de datos en last_boosted_vcpu en kvm_vcpu_on_spin() Utilice {READ,WRITE}_ONCE() para acceder a kvm-\u0026gt;last_boosted_vcpu para garantizar que las cargas y los almacenes sean at\u00f3micos. En el escenario extremadamente improbable de que el compilador rompa los almacenes, es te\u00f3ricamente posible que KVM intente obtener una vCPU utilizando un \u00edndice fuera de los l\u00edmites, por ejemplo, si la escritura se divide en varios almacenes de 8 bits y se combina con un 32 -carga de bits en una VM con 257 vCPU: CPU0 CPU1 last_boosted_vcpu = 0xff; (last_boosted_vcpu = 0x100) last_boosted_vcpu[15:8] = 0x01; i = (last_boosted_vcpu = 0x1ff) last_boosted_vcpu[7:0] = 0x00; vcpu = kvm-\u0026gt;vcpu_array[0x1ff]; Seg\u00fan lo detectado por KCSAN: ERROR: KCSAN: ejecuci\u00f3n de datos en kvm_vcpu_on_spin [kvm] / kvm_vcpu_on_spin [kvm] escribe en 0xffffc90025a92344 de 4 bytes por tarea 4340 en la CPU 16: kvm_vcpu_on_spin (arch/x86/kvm/../../. ./virt/kvm/kvm_main.c:4112) kvm handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:? arch/x86/kvm /vmx/vmx.c:6606) kvm_intel vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c :890) __x64_sys_ioctl (fs/ioctl.c:890) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) Entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64 .S:130) le\u00eddo en 0xffffc90025a92344 de 4 bytes por la tarea 4342 en la CPU 4: kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4069) kvm handle_pause (arch/ x86/kvm/vmx/vmx.c:5929) kvm_intel vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:? arch/x86/kvm/vmx/vmx.c:6606) kvm_intel vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86 .c:?) kvm kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890) __x64_sys_ioctl (fs/ioctl.c:890) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) Entry_SYSCALL_64_after_hwframe (arch/ x86/entry/entry_64.S:130) valor cambiado: 0x00000012 -\u0026gt; 0x00000000\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"virt/kvm/kvm_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\",\"lessThan\":\"11a772d5376aa6d3e2e69b5b5c585f79b60c0e17\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\",\"lessThan\":\"4c141136a28421b78f34969b25a4fa32e06e2180\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\",\"lessThan\":\"71fbc3af3dacb26c3aa2f30bb3ab05c44d082c84\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\",\"lessThan\":\"82bd728a06e55f5b5f93d10ce67f4fe7e689853a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\",\"lessThan\":\"92c77807d938145c7c3350c944ef9f39d7f6017c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\",\"lessThan\":\"a937ef951bba72f48d2402451419d725d70dba20\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\",\"lessThan\":\"95c8dd79f3a14df96b3820b35b8399bd91b2be60\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\",\"lessThan\":\"49f683b41f28918df3e51ddc0d928cb2e934ccdb\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"virt/kvm/kvm_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.39\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.39\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.323\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.285\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.228\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.169\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.96\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.36\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.7\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H\",\"baseScore\":7.9,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":5.3},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:03:52.034893Z\",\"id\":\"CVE-2024-40953\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.39\",\"versionEndExcluding\":\"4.19.323\",\"matchCriteriaId\":\"5A3583A3-7039-4012-9458-F67912AED1CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.285\",\"matchCriteriaId\":\"B5A89369-320F-47FC-8695-56F61F87E4C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.228\",\"matchCriteriaId\":\"9062315F-AB89-4ABE-8C13-B75927689F66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.169\",\"matchCriteriaId\":\"18BEDAD6-86F8-457C-952F-C35698B3D07F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.96\",\"matchCriteriaId\":\"61E887B4-732A-40D2-9983-CC6F281EBFB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.36\",\"matchCriteriaId\":\"E1046C95-860A-45B0-B718-2B29F65BFF10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.7\",\"matchCriteriaId\":\"0A047AF2-94AC-4A3A-B32D-6AB930D8EF1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3173713D-909A-4DD3-9DD4-1E171EB057EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"79F18AFA-40F7-43F0-BA30-7BDB65F918B9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/11a772d5376aa6d3e2e69b5b5c585f79b60c0e17\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/49f683b41f28918df3e51ddc0d928cb2e934ccdb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c141136a28421b78f34969b25a4fa32e06e2180\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/71fbc3af3dacb26c3aa2f30bb3ab05c44d082c84\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/82bd728a06e55f5b5f93d10ce67f4fe7e689853a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/92c77807d938145c7c3350c944ef9f39d7f6017c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/95c8dd79f3a14df96b3820b35b8399bd91b2be60\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a937ef951bba72f48d2402451419d725d70dba20\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/49f683b41f28918df3e51ddc0d928cb2e934ccdb\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/92c77807d938145c7c3350c944ef9f39d7f6017c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/95c8dd79f3a14df96b3820b35b8399bd91b2be60\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a937ef951bba72f48d2402451419d725d70dba20\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-04T18:43:28+00:00",
"cve": "CVE-2024-40953",
"id": "CVE-2024-40953",
"initial_release_date": "2024-07-12T00:00:00+00:00",
"product_status:known_not_affected": "198",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-40953.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-06T17:03:12Z",
"cve": "CVE-2024-40953",
"id": "CVE-2024-40953",
"initial_release_date": "2024-07-16T02:34:22Z",
"product_status:known_affected": "586",
"product_status:recommended": "735",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2024-40953",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-40953.json",
"version": "79"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/92c77807d938145c7c3350c944ef9f39d7f6017c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a937ef951bba72f48d2402451419d725d70dba20\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/95c8dd79f3a14df96b3820b35b8399bd91b2be60\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/49f683b41f28918df3e51ddc0d928cb2e934ccdb\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T21:58:17.097Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40953\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:03:52.034893Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:22.465Z\"}}], \"cna\": {\"title\": \"KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\", \"lessThan\": \"11a772d5376aa6d3e2e69b5b5c585f79b60c0e17\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\", \"lessThan\": \"4c141136a28421b78f34969b25a4fa32e06e2180\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\", \"lessThan\": \"71fbc3af3dacb26c3aa2f30bb3ab05c44d082c84\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\", \"lessThan\": \"82bd728a06e55f5b5f93d10ce67f4fe7e689853a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\", \"lessThan\": \"92c77807d938145c7c3350c944ef9f39d7f6017c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\", \"lessThan\": \"a937ef951bba72f48d2402451419d725d70dba20\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\", \"lessThan\": \"95c8dd79f3a14df96b3820b35b8399bd91b2be60\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"217ece6129f2d3b4fdd18d9e79be9e43d8d14a42\", \"lessThan\": \"49f683b41f28918df3e51ddc0d928cb2e934ccdb\", \"versionType\": \"git\"}], \"programFiles\": [\"virt/kvm/kvm_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.39\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.39\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.323\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.285\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.228\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.169\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.96\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.36\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"virt/kvm/kvm_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/11a772d5376aa6d3e2e69b5b5c585f79b60c0e17\"}, {\"url\": \"https://git.kernel.org/stable/c/4c141136a28421b78f34969b25a4fa32e06e2180\"}, {\"url\": \"https://git.kernel.org/stable/c/71fbc3af3dacb26c3aa2f30bb3ab05c44d082c84\"}, {\"url\": \"https://git.kernel.org/stable/c/82bd728a06e55f5b5f93d10ce67f4fe7e689853a\"}, {\"url\": \"https://git.kernel.org/stable/c/92c77807d938145c7c3350c944ef9f39d7f6017c\"}, {\"url\": \"https://git.kernel.org/stable/c/a937ef951bba72f48d2402451419d725d70dba20\"}, {\"url\": \"https://git.kernel.org/stable/c/95c8dd79f3a14df96b3820b35b8399bd91b2be60\"}, {\"url\": \"https://git.kernel.org/stable/c/49f683b41f28918df3e51ddc0d928cb2e934ccdb\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()\\n\\nUse {READ,WRITE}_ONCE() to access kvm-\u003elast_boosted_vcpu to ensure the\\nloads and stores are atomic. In the extremely unlikely scenario the\\ncompiler tears the stores, it\u0027s theoretically possible for KVM to attempt\\nto get a vCPU using an out-of-bounds index, e.g. if the write is split\\ninto multiple 8-bit stores, and is paired with a 32-bit load on a VM with\\n257 vCPUs:\\n\\n CPU0 CPU1\\n last_boosted_vcpu = 0xff;\\n\\n (last_boosted_vcpu = 0x100)\\n last_boosted_vcpu[15:8] = 0x01;\\n i = (last_boosted_vcpu = 0x1ff)\\n last_boosted_vcpu[7:0] = 0x00;\\n\\n vcpu = kvm-\u003evcpu_array[0x1ff];\\n\\nAs detected by KCSAN:\\n\\n BUG: KCSAN: data-race in kvm_vcpu_on_spin [kvm] / kvm_vcpu_on_spin [kvm]\\n\\n write to 0xffffc90025a92344 of 4 bytes by task 4340 on cpu 16:\\n kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112) kvm\\n handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel\\n vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?\\n\\t\\t arch/x86/kvm/vmx/vmx.c:6606) kvm_intel\\n vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm\\n kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm\\n kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm\\n __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)\\n __x64_sys_ioctl (fs/ioctl.c:890)\\n x64_sys_call (arch/x86/entry/syscall_64.c:33)\\n do_syscall_64 (arch/x86/entry/common.c:?)\\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\\n\\n read to 0xffffc90025a92344 of 4 bytes by task 4342 on cpu 4:\\n kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4069) kvm\\n handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel\\n vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?\\n\\t\\t\\tarch/x86/kvm/vmx/vmx.c:6606) kvm_intel\\n vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm\\n kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm\\n kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm\\n __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)\\n __x64_sys_ioctl (fs/ioctl.c:890)\\n x64_sys_call (arch/x86/entry/syscall_64.c:33)\\n do_syscall_64 (arch/x86/entry/common.c:?)\\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\\n\\n value changed: 0x00000012 -\u003e 0x00000000\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.323\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.285\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.228\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.169\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.96\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.36\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.7\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"2.6.39\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:23:01.403Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-40953\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:23:01.403Z\", \"dateReserved\": \"2024-07-12T12:17:45.592Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:31:56.832Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…