CVE-2024-31076

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline

The absence of IRQD_MOVE_PCNTXT prevents immediate effectiveness of

interrupt affinity reconfiguration via procfs. Instead, the change is

deferred until the next instance of the interrupt being triggered on the

original CPU.

When the interrupt next triggers on the original CPU, the new affinity is

enforced within __irq_move_irq(). A vector is allocated from the new CPU,

but the old vector on the original CPU remains and is not immediately

reclaimed. Instead, apicd->move_in_progress is flagged, and the reclaiming

process is delayed until the next trigger of the interrupt on the new CPU.

Upon the subsequent triggering of the interrupt on the new CPU,

irq_complete_move() adds a task to the old CPU's vector_cleanup list if it

remains online. Subsequently, the timer on the old CPU iterates over its

vector_cleanup list, reclaiming old vectors.

However

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References