Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw can make the Intel Speed Select Technology driver read beyond allocated memory when an SST PCI device is attached to a virtual machine. The supplied rating is high because successful abuse could affect confidentiality, integrity, and availability, although the public evidence only demonstrates a KASAN-detected invalid read.
Executive priority
Treat as a high-priority kernel maintenance issue for virtualization environments using Intel SST device assignment. Patch exposed systems through supported vendor channels promptly. Broader emergency action is not supported by the current evidence because no active exploitation is reported and the demonstrated outcome is an invalid memory read.
Technical view
CVE-2024-49886 is a slab out-of-bounds read in _isst_if_get_pci_dev within isst_if_common, reached during a CPU-online callback. The reported trigger is attaching an SST PCI device to a VM. KASAN observed an eight-byte read immediately beyond a 512-byte allocation. Linux stable commits resolve the defect.
Likely exposure
Prioritize systems running the listed affected Linux kernel versions where Intel SST/ISST support is present and SST PCI devices may be assigned to virtual machines. Systems without this driver or device-assignment scenario appear less exposed, but the supplied data does not establish every required configuration or distribution-specific package range.
Exploitation context
The supplied CVSS 3.1 score is 7.8 with local access and low privileges required. No user interaction is required. The record is not in KEV, and the provided sources do not report active exploitation or a public exploit. Demonstrated evidence is limited to a KASAN-detected out-of-bounds read.
Researcher notes
The report places the invalid eight-byte read exactly at the end of a kmalloc-512 object during isst_if_cpu_online. The supplied CVSS asserts possible complete confidentiality, integrity, and availability impact, but the source bundle does not demonstrate privilege escalation, code execution, or denial of service. Distribution backport status requires vendor-specific verification.
Mitigation direction
- Upgrade to a distribution-supported kernel containing the applicable referenced Linux stable fix.
- Review Linux vendor advisories to map kernel package versions to the upstream corrective commits.
- Restrict SST PCI device assignment to virtual machines until affected kernels are updated.
- Use the Debian LTS advisory where applicable to identify the supported security update.
Validation and detection
- Inventory kernel versions on systems using Intel SST or ISST components.
- Identify virtual machines receiving SST PCI device assignments or passthrough.
- Confirm installed kernel packages include the applicable upstream stable fix.
- Review kernel logs for KASAN slab-out-of-bounds reports involving _isst_if_get_pci_dev.
- Retest authorized SST device attachment after updating, without reproducing offensive exploitation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49886 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1973c4d8ee0782a808303d75e3be9c12baaacd97CVE reference, Linux
- https://git.kernel.org/stable/c/cdd03afcb6eda3103da5a0948d3db12372f62910CVE reference, Linux
- https://git.kernel.org/stable/c/8176d4878ed2af5d93ddd0e971e24c412124d38bCVE reference, Linux
- https://git.kernel.org/stable/c/cebc705b097d5c16469b141a25e840161d1c517aCVE reference, Linux
- https://git.kernel.org/stable/c/afa7f78d9a907cfded6c98c91aae2bf7b3b56e51CVE reference, Linux
- https://git.kernel.org/stable/c/7d59ac07ccb58f8f604f8057db63b8efcebeb3deCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.