CVE-2024-31143
Xen ≥ 4.4.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-31143 is a high-severity Unlock of a Resource that is not Locked (CWE-832) vulnerability in Xen Xen. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-29053
Vulnerability Data
An optional feature of PCI MSI called "Multiple Message" allows a device to use multiple consecutive interrupt vectors. Unlike for MSI-X, the setting up of these consecutive vectors needs to happen all in one go. In this handling an error…
more
path could be taken in different situations, with or without a particular lock held. This error path wrongly releases the lock even when it is not currently held.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent introduction of synchronization errors such as unlocking unlocked resources.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing may detect the flaw but does not prevent it by itself.
Secure development lifecycle practices can include concurrency and locking rules that prevent unlock-without-lock errors.
Secure system architecture and engineering principles can mandate proper resource-locking patterns.
Secure coding standards can explicitly forbid unlocking resources that were never locked.