CVE-2024-46830
Estado: ModificadaAlta (7.8)—
Detalles técnicos trazas, registros y código del informe original
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: x86: Adquirir kvm->srcu al manejar KVM_SET_VCPU_EVENTS Adquiera kvm->srcu al procesar KVM_SET_VCPU_EVENTS, ya que KVM abandonará a la fuerza el VMX/SVM anidado si se alterna el modo SMM, y al abandonar el VMX anidado se lee la memoria del invitado. Tenga en cuenta que kvm_vcpu_ioctl_x86_set_vcpu_events() también se puede llamar desde KVM_RUN a través de sync_regs(), que ya contiene SRCU. Es decir, intentar usar con precisión kvm_vcpu_srcu_read_lock() alrededor del código SMM problemático causaría problemas. Adquirir SRCU no es tan caro, así que para simplificar, tómelo incondicionalmente para KVM_SET_VCPU_EVENTS. ============================= ADVERTENCIA: uso sospechoso de RCU 6.10.0-rc7-332d2c1d713e-next-vm #552 No contaminado ----------------------------- include/linux/kvm_host.h:1027 ¡Uso sospechoso de rcu_dereference_check()! Otra información que podría ayudarnos a depurar esto: rcu_scheduler_active = 2, debug_locks = 1 1 bloqueo retenido por repro/1071: #0: ffff88811e424430 (&vcpu->mutex){+.+.}-{3:3}, en: kvm_vcpu_ioctl+0x7d/0x970 [kvm] seguimiento de pila: CPU: 15 PID: 1071 Comm: repro No contaminado 6.10.0-rc7-332d2c1d713e-next-vm #552 Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Seguimiento de llamadas: dump_stack_lvl+0x7f/0x90 kvm_vcpu_ioctl_x86_set_vcpu_events+0x15d/0x2b0 [kvm] kvm_arch_vcpu_ioctl+0x1107/0x1750 [kvm] ? kvm_vcpu_ioctl+0x497/0x970 [kvm] kvm_vcpu_ioctl+0x497/0x970 [kvm] ? bloqueo_adquirir+0xba/0x2d0 ? encontrar_bloqueo_retenido+0x2b/0x80 ? hacer_error_dirección_usuario+0x40c/0x6f0 ? liberación_de_bloqueo+0xb7/0x270 __x64_sys_ioctl+0x82/0xb0 hacer_llamada_al_sistema_64+0x6c/0x170 entrada_SYSCALL_64_después_de_hwframe+0x4b/0x53 RIP: 0033:0x7ff11eb1b539CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.24%
- Percentil entre todas las CVEs puntuadas: 14
- Fecha de la puntuación: 8/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- NVD-CWE-noinfo
Referencias
- https://git.kernel.org/stable/c/4bcdd831d9d01e0fb64faea50732b59b2ee88da1
- https://git.kernel.org/stable/c/5f35099fa3d59caf10bda88b033538e90086684e
- https://git.kernel.org/stable/c/939375737b5a0b1bf9b1e75129054e11bc9ca65e
- https://git.kernel.org/stable/c/ecdbe8ac86fb5538ccc623a41f88ec96c7168ab9
- https://git.kernel.org/stable/c/fa297c33faefe51e10244e8a378837fca4963228
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-46830",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-46830",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-09-29T14:12:09.375859Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "e302786233e6bc512986d007c96458ccf5ca21c7",
"lessThan": "5f35099fa3d59caf10bda88b033538e90086684e",
"versionType": "git"
},
{
"status": "affected",
"version": "f7e570780efc5cec9b2ed1e0472a7da14e864fdb",
"lessThan": "fa297c33faefe51e10244e8a378837fca4963228",
"versionType": "git"
},
{
"status": "affected",
"version": "f7e570780efc5cec9b2ed1e0472a7da14e864fdb",
"lessThan": "939375737b5a0b1bf9b1e75129054e11bc9ca65e",
"versionType": "git"
},
{
"status": "affected",
"version": "f7e570780efc5cec9b2ed1e0472a7da14e864fdb",
"lessThan": "ecdbe8ac86fb5538ccc623a41f88ec96c7168ab9",
"versionType": "git"
},
{
"status": "affected",
"version": "f7e570780efc5cec9b2ed1e0472a7da14e864fdb",
"lessThan": "4bcdd831d9d01e0fb64faea50732b59b2ee88da1",
"versionType": "git"
},
{
"status": "affected",
"version": "080dbe7e9b86a0392d8dffc00d9971792afc121f",
"versionType": "git"
},
{
"status": "affected",
"version": "b4c0d89c92e957ecccce12e66b63875d0cc7af7e",
"versionType": "git"
},
{
"status": "affected",
"version": "5.15.19",
"lessThan": "5.15.198",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.10.97",
"lessThan": "5.11",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.16.5",
"lessThan": "5.17",
"versionType": "semver"
}
],
"programFiles": [
"arch/x86/kvm/x86.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.198",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.110",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.51",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.10.10",
"versionType": "semver",
"lessThanOrEqual": "6.10.*"
},
{
"status": "unaffected",
"version": "6.11",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"arch/x86/kvm/x86.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2024-09-27T13:15:15.380",
"references": [
{
"url": "https://git.kernel.org/stable/c/4bcdd831d9d01e0fb64faea50732b59b2ee88da1",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5f35099fa3d59caf10bda88b033538e90086684e",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/939375737b5a0b1bf9b1e75129054e11bc9ca65e",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ecdbe8ac86fb5538ccc623a41f88ec96c7168ab9",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fa297c33faefe51e10244e8a378837fca4963228",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS\n\nGrab kvm->srcu when processing KVM_SET_VCPU_EVENTS, as KVM will forcibly\nleave nested VMX/SVM if SMM mode is being toggled, and leaving nested VMX\nreads guest memory.\n\nNote, kvm_vcpu_ioctl_x86_set_vcpu_events() can also be called from KVM_RUN\nvia sync_regs(), which already holds SRCU. I.e. trying to precisely use\nkvm_vcpu_srcu_read_lock() around the problematic SMM code would cause\nproblems. Acquiring SRCU isn't all that expensive, so for simplicity,\ngrab it unconditionally for KVM_SET_VCPU_EVENTS.\n\n =============================\n WARNING: suspicious RCU usage\n 6.10.0-rc7-332d2c1d713e-next-vm #552 Not tainted\n -----------------------------\n include/linux/kvm_host.h:1027 suspicious rcu_dereference_check() usage!\n\n other info that might help us debug this:\n\n rcu_scheduler_active = 2, debug_locks = 1\n 1 lock held by repro/1071:\n #0: ffff88811e424430 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x7d/0x970 [kvm]\n\n stack backtrace:\n CPU: 15 PID: 1071 Comm: repro Not tainted 6.10.0-rc7-332d2c1d713e-next-vm #552\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n Call Trace:\n <TASK>\n dump_stack_lvl+0x7f/0x90\n lockdep_rcu_suspicious+0x13f/0x1a0\n kvm_vcpu_gfn_to_memslot+0x168/0x190 [kvm]\n kvm_vcpu_read_guest+0x3e/0x90 [kvm]\n nested_vmx_load_msr+0x6b/0x1d0 [kvm_intel]\n load_vmcs12_host_state+0x432/0xb40 [kvm_intel]\n vmx_leave_nested+0x30/0x40 [kvm_intel]\n kvm_vcpu_ioctl_x86_set_vcpu_events+0x15d/0x2b0 [kvm]\n kvm_arch_vcpu_ioctl+0x1107/0x1750 [kvm]\n ? mark_held_locks+0x49/0x70\n ? kvm_vcpu_ioctl+0x7d/0x970 [kvm]\n ? kvm_vcpu_ioctl+0x497/0x970 [kvm]\n kvm_vcpu_ioctl+0x497/0x970 [kvm]\n ? lock_acquire+0xba/0x2d0\n ? find_held_lock+0x2b/0x80\n ? do_user_addr_fault+0x40c/0x6f0\n ? lock_release+0xb7/0x270\n __x64_sys_ioctl+0x82/0xb0\n do_syscall_64+0x6c/0x170\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7ff11eb1b539\n </TASK>"
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: x86: Adquirir kvm->srcu al manejar KVM_SET_VCPU_EVENTS Adquiera kvm->srcu al procesar KVM_SET_VCPU_EVENTS, ya que KVM abandonará a la fuerza el VMX/SVM anidado si se alterna el modo SMM, y al abandonar el VMX anidado se lee la memoria del invitado. Tenga en cuenta que kvm_vcpu_ioctl_x86_set_vcpu_events() también se puede llamar desde KVM_RUN a través de sync_regs(), que ya contiene SRCU. Es decir, intentar usar con precisión kvm_vcpu_srcu_read_lock() alrededor del código SMM problemático causaría problemas. Adquirir SRCU no es tan caro, así que para simplificar, tómelo incondicionalmente para KVM_SET_VCPU_EVENTS. ============================= ADVERTENCIA: uso sospechoso de RCU 6.10.0-rc7-332d2c1d713e-next-vm #552 No contaminado ----------------------------- include/linux/kvm_host.h:1027 ¡Uso sospechoso de rcu_dereference_check()! Otra información que podría ayudarnos a depurar esto: rcu_scheduler_active = 2, debug_locks = 1 1 bloqueo retenido por repro/1071: #0: ffff88811e424430 (&vcpu->mutex){+.+.}-{3:3}, en: kvm_vcpu_ioctl+0x7d/0x970 [kvm] seguimiento de pila: CPU: 15 PID: 1071 Comm: repro No contaminado 6.10.0-rc7-332d2c1d713e-next-vm #552 Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Seguimiento de llamadas: dump_stack_lvl+0x7f/0x90 kvm_vcpu_ioctl_x86_set_vcpu_events+0x15d/0x2b0 [kvm] kvm_arch_vcpu_ioctl+0x1107/0x1750 [kvm] ? kvm_vcpu_ioctl+0x497/0x970 [kvm] kvm_vcpu_ioctl+0x497/0x970 [kvm] ? bloqueo_adquirir+0xba/0x2d0 ? encontrar_bloqueo_retenido+0x2b/0x80 ? hacer_error_dirección_usuario+0x40c/0x6f0 ? liberación_de_bloqueo+0xb7/0x270 __x64_sys_ioctl+0x82/0xb0 hacer_llamada_al_sistema_64+0x6c/0x170 entrada_SYSCALL_64_después_de_hwframe+0x4b/0x53 RIP: 0033:0x7ff11eb1b539 "
}
],
"lastModified": "2026-08-04T11:20:30.960",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6CDC103F-CA28-421D-9F6C-F133A3A06F17",
"versionEndExcluding": "5.11",
"versionStartIncluding": "5.10.97"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5BC080EF-13AB-4B4C-A969-2E51CE23720D",
"versionEndExcluding": "5.15.198",
"versionStartIncluding": "5.15.19"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DFA0DD9B-9B37-4E0C-8DEF-2E20FE0A8B51",
"versionEndExcluding": "5.17",
"versionStartIncluding": "5.16.5"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E40366D5-0D82-49F9-AB3E-C54A428951B7",
"versionEndExcluding": "6.1.110",
"versionStartIncluding": "5.17.1"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E4529134-BAC4-4776-840B-304009E181A0",
"versionEndExcluding": "6.6.51",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACDEE48C-137A-4731-90D0-A675865E1BED",
"versionEndExcluding": "6.10.10",
"versionStartIncluding": "6.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8B3CE743-2126-47A3-8B7C-822B502CF119"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4DEB27E7-30AA-45CC-8934-B89263EF3551"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E0005AEF-856E-47EB-BFE4-90C46899394D"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39889A68-6D34-47A6-82FC-CD0BF23D6754"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8383ABF-1457-401F-9B61-EE50F4C61F4F"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B77A9280-37E6-49AD-B559-5B23A3B1DC3D"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}