CVE-2024-31145

Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. In the logic establishing these mappings, error handling was flawed, resulting in such mappings to potentially remain in place when they should have been removed again. Respective guests would then gain access to memory regions which they aren't supposed to have access to.

• CWE-400

• https://xenbits.xenproject.org/xsa/advisory-460.htmlPatch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2024/08/14/2Mailing List, Third Party Advisory
• http://xenbits.xen.org/xsa/advisory-460.htmlPatch, Vendor Advisory

Published

Sep 25, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3114An issue was discovered in GitLab CE/EE affecting all versio…6.5
• CVE-2024-31140In JetBrains TeamCity before 2024.03 server administrators c…4.9
• CVE-2024-31141Files or Directories Accessible to External Parties, Imprope…6.5
• CVE-2024-31142Because of a logical error in XSA-407 (Branch Type Confusion…7.5
• CVE-2024-31143An optional feature of PCI MSI called "Multiple Message" all…7.5
• CVE-2024-31144For a brief summary of Xapi terminology, see: https://xa…3.8
• CVE-2024-31146When multiple devices share resources and one of them is to …7.5
• CVE-2024-3115An issue was discovered in GitLab EE affecting all versions …4.3
• CVE-2024-31150Out-of-bounds read for some Intel(R) Graphics Driver softwar…4.8
• CVE-2024-31151A security flaw involving hard-coded credentials in LevelOne…9.8
• CVE-2024-31152The LevelOne WBR-6012 router with firmware R0.40e6 is vulner…7.5
• CVE-2024-31153Improper input validation for some Intel(R) QuickAssist Tech…5.5