CVE-2024-45818

The hypervisor contains code to accelerate VGA memory accesses for HVM guests, when the (virtual) VGA is in "standard" mode. Locking involved there has an unusual discipline, leaving a lock acquired past the return from the function that acquired it. This behavior results in a problem when emulating an instruction with two memory accesses, both of which touch VGA memory (plus some further constraints which aren't relevant here). When emulating the 2nd access, the lock that is already being held would be attempted to be re-acquired, resulting in a deadlock. This deadlock was already found when the code was first introduced, but was analysed incorrectly and the fix was incomplete. Analysis in light of the new finding cannot find a way to make the existing locking discipline work. In staging, this logic has all been removed because it was discovered to be accidentally disabled since Xen 4.7. Therefore, we are fixing the locking problem by backporting the removal of most of the feature. Note that even with the feature disabled, the lock would still be acquired for any accesses to the VGA MMIO region.

• CWE-667

• https://xenbits.xenproject.org/xsa/advisory-463.htmlPatch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2024/11/12/2Patch, Third Party Advisory
• http://xenbits.xen.org/xsa/advisory-463.htmlPatch, Vendor Advisory

Published

Dec 19, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45811Vite a frontend build tooling framework for javascript. In a…4.8
• CVE-2024-45812Vite a frontend build tooling framework for javascript. Affe…6.4
• CVE-2024-45813find-my-way is a fast, open source HTTP router, internally u…5.3
• CVE-2024-45815Backstage is an open framework for building developer portal…6.5
• CVE-2024-45816Backstage is an open framework for building developer portal…6.5
• CVE-2024-45817In x86's APIC (Advanced Programmable Interrupt Controller) a…7.3
• CVE-2024-45819PVH guests have their ACPI tables constructed by the toolsta…5.5
• CVE-2024-4582A vulnerability classified as critical has been found in Far…7.3
• CVE-2024-45823CVE-2024-45823 IMPACT An authentication bypass vulnerabil…9.8
• CVE-2024-45824CVE-2024-45824 IMPACT A remote code vulnerability exists …9.8
• CVE-2024-45825CVE-2024-45825 IMPACT A denial-of-service vulnerability exis…7.5
• CVE-2024-45826CVE-2024-45826 IMPACT Due to improper input validation, a pa…8.8