LiveActive security incident?Get immediate response
CVE Record

CVE-2024-36953: KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() vgic_v2_parse_attr() is responsible for finding the vCPU that matches the user-provided CPUID, which (of course) may not be valid. If the ID is invalid, kvm_get_vcpu_by_id() returns NULL, which isn't handled gracefully. Similar to the GICv3 uaccess flow, check that kvm_get_vcpu_by_id() actually returns something and fail the ioctl if not.

MediumCVSS 4.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel flaw can let a highly privileged local user trigger a host availability failure through the ARM64 KVM virtual interrupt controller path. It is not a remote compromise issue and the sources do not show data theft or integrity impact. Business urgency is highest for ARM64 virtualization hosts running affected kernels.

Executive priority

Prioritize patching ARM64 KVM hosts in production, especially shared virtualization platforms. The issue is not remotely exploitable from the provided evidence, but availability impact on virtualization infrastructure can still be operationally significant.

Technical view

In KVM on arm64, vgic_v2_parse_attr() did not handle a NULL return from kvm_get_vcpu_by_id() when an invalid user-provided CPUID was supplied. The fix checks for a valid vCPU and fails the ioctl when none exists, preventing a NULL dereference availability impact.

Likely exposure

Exposure is likely limited to Linux ARM64 systems using KVM with vgic-v2 functionality, where a local user already has high privileges or access to relevant virtualization control paths. General Linux servers without ARM64 KVM use are unlikely to be exposed based on the provided sources.

Exploitation context

The CVSS vector is local, low complexity, high privileges required, no user interaction, and high availability impact. The provided bundle marks KEV as false and contains no evidence of active exploitation or public exploit tooling.

Researcher notes

The key behavior is invalid CPUID handling in vgic_v2_parse_attr(). Validation should focus on code or package presence of the NULL vCPU check, not on attempting to trigger crashes. The affected-version evidence is kernel-source oriented, so distribution backports need vendor confirmation.

Mitigation direction

  • Update affected Linux kernels to versions containing the referenced stable fixes.
  • Apply relevant distribution advisories, including Debian LTS updates where applicable.
  • Restrict KVM device and virtualization management access to trusted administrators.
  • Check vendor kernel guidance for exact affected and fixed package versions.

Validation and detection

  • Inventory ARM64 virtualization hosts running Linux KVM.
  • Check kernel versions against vendor advisories and stable fix commits.
  • Verify whether guests use or require GICv2/vgic-v2 paths.
  • Review local access controls for KVM and virtualization management interfaces.
Prepared
Confidence
high
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-36953 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.4CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H0.83.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

4.4Medium
CVSS 3.1 vector shape for CVE-2024-36953Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7d450e2821710718fd6703e9c486249cee913bab, 7d450e2821710718fd6703e9c486249cee913bab, 7d450e2821710718fd6703e9c486249cee913bab, 7d450e2821710718fd6703e9c486249cee913bab, 7d450e2821710718fd6703e9c486249cee913bab, 7d450e2821710718fd6703e9c486249cee913babunaffected
LinuxLinux4.7, 0, 5.10.217, 5.15.159, 6.1.91, 6.6.31, 6.8.10, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.