LiveActive security incident?Get immediate response
CVE Record

CVE-2024-47748: vhost_vdpa: assign irq bypass producer token correctly

In the Linux kernel, the following vulnerability has been resolved: vhost_vdpa: assign irq bypass producer token correctly We used to call irq_bypass_unregister_producer() in vhost_vdpa_setup_vq_irq() which is problematic as we don't know if the token pointer is still valid or not. Actually, we use the eventfd_ctx as the token so the life cycle of the token should be bound to the VHOST_SET_VRING_CALL instead of vhost_vdpa_setup_vq_irq() which could be called by set_status(). Fixing this by setting up irq bypass producer's token when handling VHOST_SET_VRING_CALL and un-registering the producer before calling vhost_vring_ioctl() to prevent a possible use after free as eventfd could have been released in vhost_vring_ioctl(). And such registering and unregistering will only be done if DRIVER_OK is set.

HighCVSS 7.8Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux vhost-vdpa flaw can leave the kernel using a released event-notification object. On affected virtualization hosts, a local low-privileged attacker could potentially crash the system or compromise data and kernel integrity. Exposure depends on whether vhost-vdpa is present, used, and accessible.

Executive priority

Treat this as a high-priority host-hardening issue for virtualization infrastructure using vhost-vdpa, especially where untrusted local workloads operate. Expedite vendor-supported kernel updates. Lower the priority for systems where the component is absent or inaccessible, while documenting that conclusion.

Technical view

The IRQ-bypass producer used an eventfd_ctx token whose lifetime was incorrectly tied to vhost_vdpa_setup_vq_irq(). Because set_status() can invoke that path after the eventfd is released, a possible use-after-free exists. The fix binds registration to VHOST_SET_VRING_CALL and unregisters before vhost_vring_ioctl(), when DRIVER_OK is set.

Likely exposure

Relevant Linux systems using vhost-vdpa are the likely exposure. The bundle lists affected version points from 5.9 through 6.12, but distribution backports make version-only assessment unreliable. Systems without vhost-vdpa use or without local access to the relevant interface have lower practical exposure.

Exploitation context

The CVSS 3.1 score is 7.8: local access, low complexity, low privileges, and no user interaction, with potentially high confidentiality, integrity, and availability impact. The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or a public exploit.

Researcher notes

The source assigns no CWE, although the kernel description identifies a possible use-after-free involving eventfd_ctx token lifetime. The record supplies multiple stable-branch commits but no reproduction details, exploitation evidence, or precise distribution package mapping. Researchers should distinguish theoretical CVSS impact from demonstrated exploitability.

Mitigation direction

  • Install a vendor kernel containing the appropriate stable fix for CVE-2024-47748.
  • Consult distribution guidance because fixed code may be backported without changing the upstream version meaningfully.
  • Restrict local access to vhost-vdpa interfaces until affected hosts are updated.
  • Disable unused vhost-vdpa functionality where operationally safe and supported.

Validation and detection

  • Inventory kernels on hosts providing vhost-vdpa-backed virtualization.
  • Confirm whether the vhost_vdpa module or functionality is enabled and actively used.
  • Verify installed packages include the vendor backport or referenced stable-kernel fix.
  • Reboot into the updated kernel and confirm the running version.
  • Review vendor advisories rather than relying solely on upstream version numbers.
Prepared
Confidence
medium
Sources
11

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-47748 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-47748Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2cf1ba9a4d15cb78b96ea97f727b93382c3f9a60, 2cf1ba9a4d15cb78b96ea97f727b93382c3f9a60, 2cf1ba9a4d15cb78b96ea97f727b93382c3f9a60, 2cf1ba9a4d15cb78b96ea97f727b93382c3f9a60, 2cf1ba9a4d15cb78b96ea97f727b93382c3f9a60, 2cf1ba9a4d15cb78b96ea97f727b93382c3f9a60, 2cf1ba9a4d15cb78b96ea97f727b93382c3f9a60unaffected
LinuxLinux5.9, 0, 5.10.227, 5.15.168, 6.1.113, 6.6.54, 6.10.13, 6.11.2, 6.12affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.