Security readout for executives and security teams
Plain-English summary
A low-privileged local user on an affected Linux system using x86 TDX may trick the kernel into treating user-requested memory-mapped I/O as a legitimate kernel operation. The supplied CVSS assessment indicates possible serious confidentiality, integrity, and availability impact, but exploitation requires local access.
Executive priority
Treat this as a high-priority kernel update for TDX-enabled systems with multi-user, tenant, or untrusted workload exposure. Prioritize by local code-execution opportunity rather than internet exposure. Ordinary Linux systems without TDX are lower priority for this specific flaw, subject to vendor confirmation.
Technical view
TDX permits kernel-initiated MMIO. The vulnerable check trusted that a #VE raised during kernel execution represented kernel-originated MMIO. Userspace could instead supply an MMIO address to a syscall whose get_user() or put_user() access triggers #VE. The fix verifies that the target MMIO address is within kernel space before instruction decoding.
Likely exposure
Exposure is concentrated in affected x86 Linux environments using TDX, especially where untrusted or low-privileged users can execute code. The local attack vector means network reachability alone is insufficient. Systems not using TDX are unlikely to reach the affected path, although administrators should confirm this against their vendor configuration guidance.
Exploitation context
The supplied CVSS 3.1 score is 7.8 with local access, low complexity, low privileges, and no user interaction. The bundle does not identify public exploitation, and the CVE is not listed as KEV. No claim of active exploitation is supported by the provided evidence.
Researcher notes
The core trust-boundary error is checking where #VE occurred rather than validating the MMIO target address. The fix adds target-address validation before decoding. The bundle lists multiple stable commits but does not map each commit to a kernel series, and its version entries include ambiguous values; use distribution advisories for definitive applicability.
Mitigation direction
- Apply the distribution kernel update incorporating the applicable cited Linux stable fix.
- Prioritize TDX hosts allowing untrusted or low-privileged local code execution.
- Check vendor guidance for exact fixed packages because the supplied affected-version data is ambiguous.
- Restrict unnecessary local accounts and workload execution until affected TDX hosts are updated.
Validation and detection
- Inventory x86 Linux hosts using TDX and record their running kernel builds.
- Compare installed builds with vendor advisories and the applicable cited stable commit.
- After updating, reboot where required and confirm the corrected kernel is running.
- Verify TDX workloads remain healthy and security monitoring shows no unexpected kernel exceptions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-47727 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/25703a3c980e21548774eea8c8a87a75c5c8f58cCVE reference, Linux
- https://git.kernel.org/stable/c/4c0c5dcb5471de5fc8f0a1c4980e5815339e1ceeCVE reference, Linux
- https://git.kernel.org/stable/c/18ecd5b74682839e7cdafb7cd1ec106df7baa18cCVE reference, Linux
- https://git.kernel.org/stable/c/bca2e29f7e26ce7c3522f8b324c0bd85612f68e3CVE reference, Linux
- https://git.kernel.org/stable/c/d4fc4d01471528da8a9797a065982e05090e1d81CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.