CVE-2024-53214

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Properly hide first-in-list PCIe extended capability

There are cases where a PCIe extended capability should be hidden from

the user. For example, an unknown capability (i.e., capability with ID

greater than PCI_EXT_CAP_ID_MAX) or a capability that is intentionally

chosen to be hidden from the user.

Hiding a capability is done by virtualizing and modifying the 'Next

Capability Offset' field of the previous capability so it points to the

capability after the one that should be hidden.

The special case where the first capability in the list should be hidden

is handled differently because there is no previous capability that can

be modified. In this case, the capability ID and version are zeroed

while leaving the next pointer intact. This hides the capability and

leaves an anchor for the rest of the capability list.

However, today, hiding the first capability in the list is not done

properly if the capabili

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References