Security readout for executives and security teams
Plain-English summary
A Linux virtio packed-ring cleanup flaw can leave an indirect descriptor table mapped after buffer detachment, potentially consuming resources and affecting availability. The source rates it high at CVSS 7.5, but also states the bug does not occur in current drivers because none combine premapped buffers with indirect descriptors.
Executive priority
Schedule remediation through standard kernel patching, prioritizing virtualization hosts or appliances with customized virtio drivers. Emergency action is not supported by the supplied evidence because the vulnerable driver combination is reportedly unused and active exploitation is undocumented. Escalate if internal validation finds that combination enabled.
Technical view
When DMA API use and premapped mode are both enabled, do_unmap becomes false, preventing detach_buf_packed from calling vring_unmap_extra_packed. Indirect descriptor tables therefore remain mapped. The kernel fix checks use_dma_api instead and synchronizes DMA-information handling with that decision.
Likely exposure
Exposure appears limited despite the high theoretical availability score. Systems require Linux virtio packed rings using DMA API, premapped buffers, and indirect descriptors together. The source explicitly says no driver uses the vulnerable premapped-plus-indirect combination. Confirm downstream configuration and backports because the supplied version data is ambiguous.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. The CVSS vector describes network reachability without privileges or user interaction, but the stated driver limitation substantially reduces practical exposure. Treat exploitation feasibility as unconfirmed.
Researcher notes
The defect is an unmap leak in packed virtqueues, affecting availability rather than confidentiality or integrity. Practical reproduction depends on an uncommon configuration the source says current drivers do not use. The bundle lists affected versions and four stable commits but does not map each commit to a kernel branch; verify downstream backports directly.
Mitigation direction
- Identify vendor-supported kernels containing the applicable referenced stable fix.
- Apply the relevant kernel update through normal distribution or appliance maintenance procedures.
- Until updated, avoid enabling the premapped-plus-indirect virtio combination where operationally feasible.
- Check distribution or appliance vendor guidance for exact fixed package versions and required reboots.
Validation and detection
- Inventory Linux kernel versions on systems using virtio packed rings.
- Determine whether virtio drivers use DMA API, premapped buffers, and indirect descriptors together.
- Verify the installed kernel includes an applicable referenced stable commit or vendor backport.
- After updating, confirm the expected kernel is running and repeat workload health checks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-27066 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e142169aca5546ae6619c39a575cda8105362100CVE reference, Linux
- https://git.kernel.org/stable/c/75450ff8c6fe8755bf5b139b238eaf9739cfd64eCVE reference, Linux
- https://git.kernel.org/stable/c/51bacd9d29bf98c3ebc65e4a0477bb86306b4140CVE reference, Linux
- https://git.kernel.org/stable/c/d5c0ed17fea60cca9bc3bf1278b49ba79242bbcdCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.