CVE-2024-31142 - Vulnerability Details - OpenCVE

Because of a logical error in XSA-407 (Branch Type Confusion), the mitigation is not applied properly when it is intended to be used. XSA-434 (Speculative Return Stack Overflow) uses the same infrastructure, so is equally impacted. For more details, see: https://xenbits.xen.org/xsa/advisory-407.html https://xenbits.xen.org/xsa/advisory-434.html

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Xen	Xen

No data.

No data.

References

Link	Providers
https://xenbits.xenproject.org/xsa/advisory-455.html

History

Thu, 27 Mar 2025 21:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-693
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: XEN

Published: 2024-05-16T13:39:42.774Z

Updated: 2025-03-27T21:00:51.019Z

Reserved: 2024-03-28T18:14:12.892Z

Link: CVE-2024-31142

Vulnrichment

Updated: 2024-08-02T01:46:04.491Z

NVD

Status : Awaiting Analysis

Published: 2024-05-16T14:15:08.903

Modified: 2025-03-27T21:15:48.497

Link: CVE-2024-31142

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-31142", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "state": "PUBLISHED", "assignerShortName": "XEN", "dateReserved": "2024-03-28T18:14:12.892Z", "datePublished": "2024-05-16T13:39:42.774Z", "dateUpdated": "2025-03-27T21:00:51.019Z"}, "containers": {"cna": {"title": "x86: Incorrect logic for BTC/SRSO mitigations", "datePublic": "2024-04-09T16:29:00.000Z", "descriptions": [{"lang": "en", "value": "Because of a logical error in XSA-407 (Branch Type Confusion), the\nmitigation is not applied properly when it is intended to be used.\nXSA-434 (Speculative Return Stack Overflow) uses the same\ninfrastructure, so is equally impacted.\n\nFor more details, see:\n https://xenbits.xen.org/xsa/advisory-407.html\n https://xenbits.xen.org/xsa/advisory-434.html\n"}], "impacts": [{"descriptions": [{"lang": "en", "value": "XSAs 407 and 434 are unmitigated, even when the patches are in place.\n"}]}], "affected": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-455"}]}], "configurations": [{"lang": "en", "value": "All versions of Xen containing the XSA-407 fixes are vulnerable.\n\nSee XSAs 407 and 434 for details on which hardware is susceptible to\nBTC/SRSO.\n"}], "workarounds": [{"lang": "en", "value": "There are no mitigations.\n"}], "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by Andrew Cooper of XenServer.\n"}], "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-455.html"}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2024-05-16T13:39:42.774Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-693", "lang": "en", "description": "CWE-693 Protection Mechanism Failure"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-05-20T13:51:28.453648Z", "id": "CVE-2024-31142", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-27T21:00:51.019Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:46:04.491Z"}, "title": "CVE Program Container", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-455.html", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-455.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:46:04.491Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-31142", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-20T13:51:28.453648Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693 Protection Mechanism Failure"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-20T13:51:31.705Z"}}], "cna": {"title": "x86: Incorrect logic for BTC/SRSO mitigations", "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by Andrew Cooper of XenServer.\n"}], "impacts": [{"descriptions": [{"lang": "en", "value": "XSAs 407 and 434 are unmitigated, even when the patches are in place.\n"}]}], "affected": [{"vendor": "Xen", "product": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-455"}], "defaultStatus": "unknown"}], "datePublic": "2024-04-09T16:29:00.000Z", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-455.html"}], "workarounds": [{"lang": "en", "value": "There are no mitigations.\n"}], "descriptions": [{"lang": "en", "value": "Because of a logical error in XSA-407 (Branch Type Confusion), the\nmitigation is not applied properly when it is intended to be used.\nXSA-434 (Speculative Return Stack Overflow) uses the same\ninfrastructure, so is equally impacted.\n\nFor more details, see:\n https://xenbits.xen.org/xsa/advisory-407.html\n https://xenbits.xen.org/xsa/advisory-434.html\n"}], "configurations": [{"lang": "en", "value": "All versions of Xen containing the XSA-407 fixes are vulnerable.\n\nSee XSAs 407 and 434 for details on which hardware is susceptible to\nBTC/SRSO.\n"}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2024-05-16T13:39:42.774Z"}}}, "cveMetadata": {"cveId": "CVE-2024-31142", "state": "PUBLISHED", "dateUpdated": "2025-03-27T21:00:51.019Z", "dateReserved": "2024-03-28T18:14:12.892Z", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "datePublished": "2024-05-16T13:39:42.774Z", "assignerShortName": "XEN"}, "dataVersion": "5.1"}