LiveActive security incident?Get immediate response
CVE Record

CVE-2024-50139: KVM: arm64: Fix shift-out-of-bounds bug

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix shift-out-of-bounds bug Fix a shift-out-of-bounds bug reported by UBSAN when running VM with MTE enabled host kernel. UBSAN: shift-out-of-bounds in arch/arm64/kvm/sys_regs.c:1988:14 shift exponent 33 is too large for 32-bit type 'int' CPU: 26 UID: 0 PID: 7629 Comm: qemu-kvm Not tainted 6.12.0-rc2 #34 Hardware name: IEI NF5280R7/Mitchell MB, BIOS 00.00. 2024-10-12 09:28:54 10/14/2024 Call trace: dump_backtrace+0xa0/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x74/0x90 dump_stack+0x18/0x28 __ubsan_handle_shift_out_of_bounds+0xf8/0x1e0 reset_clidr+0x10c/0x1c8 kvm_reset_sys_regs+0x50/0x1c8 kvm_reset_vcpu+0xec/0x2b0 __kvm_vcpu_set_target+0x84/0x158 kvm_vcpu_set_target+0x138/0x168 kvm_arch_vcpu_ioctl_vcpu_init+0x40/0x2b0 kvm_arch_vcpu_ioctl+0x28c/0x4b8 kvm_vcpu_ioctl+0x4bc/0x7a8 __arm64_sys_ioctl+0xb4/0x100 invoke_syscall+0x70/0x100 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x3c/0x158 el0t_64_sync_handler+0x120/0x130 el0t_64_sync+0x194/0x198

HighCVSS 7.9Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

On Arm64 Linux virtualization hosts, KVM can perform an invalid 32-bit shift while initializing a virtual CPU when host MTE is enabled. The supplied CVSS assessment rates potential availability impact as high, with lower confidentiality and integrity impacts. Systems without this specific virtualization configuration are unlikely to be exposed.

Executive priority

High priority for organizations operating Arm64 KVM hosts with MTE enabled; lower elsewhere after inventory confirmation. Schedule supported kernel remediation because potential availability impact is rated high, while recognizing that active exploitation is not evidenced.

Technical view

The flaw occurs in reset_clidr within arch/arm64/kvm/sys_regs.c. A shift exponent of 33 exceeds the width of a 32-bit int, producing undefined behavior detected by UBSAN during KVM virtual CPU initialization. The supplied CVSS 3.1 score is 7.9, with local, low-privilege access indicated.

Likely exposure

Likely exposure is limited to Arm64 Linux hosts running KVM virtual machines with host MTE enabled. The bundle lists Linux 6.3, 6.6.59, 6.11.6, and 6.12 as affected, but its version data does not clearly define complete affected or fixed ranges. Confirm status through the relevant distribution or kernel branch.

Exploitation context

The bundle does not list this CVE as KEV and provides no evidence of public or active exploitation. The CVSS vector indicates local, low-complexity, low-privilege access without user interaction. It does not establish a practical exploitation path, so exploitation status remains unconfirmed.

Researcher notes

The supplied trace reaches reset_clidr during KVM virtual CPU target initialization under qemu-kvm. Evidence confirms undefined shift behavior but does not provide a CWE, demonstrated security consequence, exploit proof, complete version boundaries, or distribution package mappings. Three upstream stable commits are referenced as remediation evidence.

Mitigation direction

  • Prioritize Arm64 virtualization hosts running KVM with host MTE enabled.
  • Apply vendor kernel packages incorporating the applicable referenced stable fix.
  • Consult distribution or kernel vendor guidance for branch-specific fixed versions.
  • Use supported vendor mitigations if immediate kernel maintenance is unavailable; none are named in the bundle.

Validation and detection

  • Inventory Arm64 KVM hosts and determine whether host MTE is enabled.
  • Record running kernel versions and compare them with vendor advisories and referenced commits.
  • Confirm the running kernel, not only the installed package, contains the applicable fix.
  • Test normal virtual CPU initialization and monitor for UBSAN shift-out-of-bounds reports.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-50139 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.9 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
1ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.9CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H25.3Linux
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

7.9High
CVSS 3.1 vector shape for CVE-2024-50139Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7af0c2534f4c57b16e92dfca8c5f40fa90fbb3f3, 7af0c2534f4c57b16e92dfca8c5f40fa90fbb3f3, 7af0c2534f4c57b16e92dfca8c5f40fa90fbb3f3unaffected
LinuxLinux6.3, 0, 6.6.59, 6.11.6, 6.12affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.