Skip to content
OpenAdvisories
Medium · 6.5 CVE-2024-45818 EUVD-2024-41272GHSA-9ppw-wh7x-2qc9

Deadlock in x86 HVM standard VGA handling

Published Dec 19, 2024 · Updated Dec 31, 2024 · Assigned by XEN

Description

The hypervisor contains code to accelerate VGA memory accesses for HVM
guests, when the (virtual) VGA is in "standard" mode. Locking involved
there has an unusual discipline, leaving a lock acquired past the
return from the function that acquired it. This behavior results in a
problem when emulating an instruction with two memory accesses, both of
which touch VGA memory (plus some further constraints which aren't
relevant here). When emulating the 2nd access, the lock that is already
being held would be attempted to be re-acquired, resulting in a
deadlock.

This deadlock was already found when the code was first introduced, but
was analysed incorrectly and the fix was incomplete. Analysis in light
of the new finding cannot find a way to make the existing locking
discipline work.

In staging, this logic has all been removed because it was discovered
to be accidentally disabled since Xen 4.7. Therefore, we are fixing the
locking problem by backporting the removal of most of the feature. Note
that even with the feature disabled, the lock would still be acquired
for any accesses to the VGA MMIO region.

Affected products

VendorProductAffectedFixed
Xen Xen — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 xen 4.19.1-1 —
Debian 13 xen 4.19.1-1 —
Debian 12 xen 4.17.5+23-ga4e5191dc0-1 DSA-5836-1
ReleasePackageFixed inAdvisory
Ubuntu 26.10 xen No fix yet —
Ubuntu 26.04 LTS xen No fix yet —
Ubuntu 25.10 xen No fix yet —
Ubuntu 24.04 LTS xen No fix yet —
Ubuntu 22.04 LTS xen No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS xen No fix yet —
Ubuntu 18.04 LTS xen No fix yet —
Ubuntu 16.04 LTS xen No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP6 xen 4.18.3_06-150600.3.12.1 SUSE-SU-2024:4163-1
SLES 15 SP5 xen 4.17.5_06-150500.3.42.1 SUSE-SU-2024:3980-1
SLES 15 SP4 xen 4.16.6_06-150400.4.65.1 SUSE-SU-2024:4116-1
SLES 15 SP3 xen 4.14.6_22-150300.3.84.1 SUSE-SU-2024:3977-1
SLES 15 SP2 xen 4.13.5_16-150200.3.99.1 SUSE-SU-2024:4073-1
Show 15 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP5 xen 4.12.4_58-3.124.1 SUSE-SU-2024:3979-1
SLES for SAP 15 SP4 xen 4.16.6_06-150400.4.65.1 SUSE-SU-2024:4116-1
SLES for SAP 15 SP3 xen 4.14.6_22-150300.3.84.1 SUSE-SU-2024:3977-1
SLES for SAP 15 SP2 xen 4.13.5_16-150200.3.99.1 SUSE-SU-2024:4073-1
SLE Micro 5.5 xen 4.17.5_06-150500.3.42.1 SUSE-SU-2024:3980-1
SLE Micro 5.4 xen 4.16.6_06-150400.4.65.1 SUSE-SU-2024:4116-1
SLE Micro 5.3 xen 4.16.6_06-150400.4.65.1 SUSE-SU-2024:4116-1
SLE Micro 5.2 xen 4.14.6_22-150300.3.84.1 SUSE-SU-2024:3977-1
SLE Micro 5.1 xen 4.14.6_22-150300.3.84.1 SUSE-SU-2024:3977-1
SLE HPC 15 SP4 xen 4.16.6_06-150400.4.65.1 SUSE-SU-2024:4116-1
SLE HPC 15 SP3 xen 4.14.6_22-150300.3.84.1 SUSE-SU-2024:3977-1
SLE HPC 15 SP2 xen 4.13.5_16-150200.3.99.1 SUSE-SU-2024:4073-1
SUSE Manager Server 4.3 xen 4.16.6_06-150400.4.65.1 SUSE-SU-2024:4116-1
SUSE Manager Proxy 4.3 xen 4.16.6_06-150400.4.65.1 SUSE-SU-2024:4116-1
SUSE Enterprise Storage 7.1 xen 4.14.6_22-150300.3.84.1 SUSE-SU-2024:3977-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed xen 4.19.0_06-1.1 openSUSE-SU-2024:14530-1
openSUSE Leap 15.6 xen 4.18.3_06-150600.3.12.1 SUSE-SU-2024:4163-1
openSUSE Leap 15.5 xen 4.17.5_06-150500.3.42.1 SUSE-SU-2024:3980-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
openSUSE Leap Micro 5.5 xen 4.17.5_06-150500.3.42.1 SUSE-SU-2024:3980-1
ReleasePackageFixed inAdvisory
Alpine v3.24 xen 4.19.0-r1 —
Alpine v3.23 xen 4.19.0-r1 —
Alpine v3.22 xen 4.19.0-r1 —
Alpine v3.21 xen 4.19.0-r1 —
Alpine v3.20 xen 4.18.3-r2 —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 xen 4.18.3-r2 —
Alpine v3.18 xen 4.17.5-r2 —
Alpine v3.17 xen 4.16.6-r3 —

Advisories 9

References