{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-39483", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-25T14:23:23.747Z", "datePublished": "2024-07-05T06:55:11.270Z", "dateUpdated": "2026-08-05T11:33:37.322Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:33:37.322Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked\n\nWhen requesting an NMI window, WARN on vNMI support being enabled if and\nonly if NMIs are actually masked, i.e. if the vCPU is already handling an\nNMI. KVM's ABI for NMIs that arrive simultanesouly (from KVM's point of\nview) is to inject one NMI and pend the other. When using vNMI, KVM pends\nthe second NMI simply by setting V_NMI_PENDING, and lets the CPU do the\nrest (hardware automatically sets V_NMI_BLOCKING when an NMI is injected).\n\nHowever, if KVM can't immediately inject an NMI, e.g. because the vCPU is\nin an STI shadow or is running with GIF=0, then KVM will request an NMI\nwindow and trigger the WARN (but still function correctly).\n\nWhether or not the GIF=0 case makes sense is debatable, as the intent of\nKVM's behavior is to provide functionality that is as close to real\nhardware as possible. E.g. if two NMIs are sent in quick succession, the\nprobability of both NMIs arriving in an STI shadow is infinitesimally low\non real hardware, but significantly larger in a virtual environment, e.g.\nif the vCPU is preempted in the STI shadow. For GIF=0, the argument isn't\nas clear cut, because the window where two NMIs can collide is much larger\nin bare metal (though still small).\n\nThat said, KVM should not have divergent behavior for the GIF=0 case based\non whether or not vNMI support is enabled. And KVM has allowed\nsimultaneous NMIs with GIF=0 for over a decade, since commit 7460fb4a3400\n(\"KVM: Fix simultaneous NMIs\"). I.e. KVM's GIF=0 handling shouldn't be\nmodified without a *really* good reason to do so, and if KVM's behavior\nwere to be modified, it should be done irrespective of vNMI support." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The attacker must be executing code inside a KVM guest on the affected AMD host, which is a local attack vector against the host kernel; there is no network-facing path to `svm_enable_nmi_window()`.\nAC:L - The guest controls both required conditions itself — it holds GIF=0 indefinitely with `CLGI` (or loops on an STI shadow) while a sibling vCPU spams NMI IPIs through the virtual LAPIC — and `vnmi` is enabled by default on all Zen 4+ hosts, so the WARN fires deterministically.\nPR:N - The attacker holds no privileges within the host's security authority; an untrusted guest is unauthenticated with respect to the host kernel, consistent with how guest-triggerable host WARN/BUG bugs in KVM are scored.\nUI:N - No host administrator or other user action is required; the guest triggers the condition entirely on its own during normal vCPU execution.\nS:C - The vulnerable code is host-kernel KVM code and the impact crosses the guest/host virtualization boundary, affecting the hypervisor and every co-tenant VM on the machine.\nC:N - The false-positive WARN produces no memory disclosure to the guest; the splat and register dump go only to host dmesg, which the guest cannot read.\nI:N - There is no memory corruption or state corruption — the commit notes KVM \"still function[s] correctly\", falling through to the single-step salvage path, so no data is modified.\nA:H - A guest can force a WARN in the host kernel, which taints the host and, on the widely used `panic_on_warn=1` configuration, panics the hypervisor and destroys all VMs running on it." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/x86/kvm/svm/svm.c" ], "versions": [ { "version": "fa4c027a7956f5e07697bfcb580d25eeb8471257", "lessThan": "f79edaf7370986d73d204b36c50cc563a4c0f356", "status": "affected", "versionType": "git" }, { "version": "fa4c027a7956f5e07697bfcb580d25eeb8471257", "lessThan": "1d87cf2eba46deaff6142366127f2323de9f84d1", "status": "affected", "versionType": "git" }, { "version": "fa4c027a7956f5e07697bfcb580d25eeb8471257", "lessThan": "b4bd556467477420ee3a91fbcba73c579669edc6", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/x86/kvm/svm/svm.c" ], "versions": [ { "version": "6.4", "status": "affected" }, { "version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.34", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.5", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.34" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.9.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/f79edaf7370986d73d204b36c50cc563a4c0f356" }, { "url": "https://git.kernel.org/stable/c/1d87cf2eba46deaff6142366127f2323de9f84d1" }, { "url": "https://git.kernel.org/stable/c/b4bd556467477420ee3a91fbcba73c579669edc6" } ], "title": "KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:26:15.663Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/f79edaf7370986d73d204b36c50cc563a4c0f356", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/1d87cf2eba46deaff6142366127f2323de9f84d1", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/b4bd556467477420ee3a91fbcba73c579669edc6", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-39483", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T17:07:35.709839Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:41.168Z" } } ] } }