CVE-2024-31143: Xen PCI MSI Race Condition Vulnerability

CVE-2024-31143 Overview

CVE-2024-31143 is a locking flaw in the Xen hypervisor affecting how it handles the PCI Message Signaled Interrupts (MSI) "Multiple Message" feature. The feature allows a device to use multiple consecutive interrupt vectors, which Xen must configure in a single operation. During this setup, an error path can be reached under different conditions, with or without a particular lock held. The error path unconditionally releases the lock, even when the caller never acquired it. This affects Xen on x86 platforms and is tracked under Xen Project Security Advisory 458.

Critical Impact

A malicious or buggy guest with PCI passthrough access can trigger lock corruption in the hypervisor, leading to denial of service, information disclosure, or potential privilege escalation across the host.

Affected Products

• Xen hypervisor on x86 architectures
• Systems exposing PCI devices to guests via passthrough
• Distributions shipping vulnerable Xen builds tracked by XSA-458

Discovery Timeline

• 2024-07-18 - CVE-2024-31143 published to NVD
• 2026-01-14 - Last updated in NVD database

Technical Details for CVE-2024-31143

Vulnerability Analysis

The vulnerability is an Exclusive Resource Management error [CWE-832], specifically the release of a lock that was never acquired. PCI MSI supports an optional capability called Multiple Message, in which a single device requests a contiguous block of interrupt vectors. Unlike MSI-X, vectors must be allocated atomically in one operation.

Xen's allocation routine for Multiple Message MSI vectors can fail at several points. The shared cleanup path that runs on these failures calls a lock release primitive without verifying the lock state for the current call context. When the error path is reached from a caller that did not take the lock, the hypervisor unlocks a resource it does not own.

Releasing an unheld lock corrupts the lock's internal accounting. Subsequent acquisitions may succeed when they should block, allowing concurrent access to shared MSI state. This produces race conditions in the hypervisor's interrupt remapping and vector allocation logic.

Root Cause

The root cause is improper error-handling logic. The shared cleanup label assumes the lock is always held, but the code paths leading to that label do not all acquire it. Because the cleanup runs unconditional release semantics, the invariant between caller context and lock ownership is broken.

Attack Vector

Exploitation requires a guest with access to a PCI device that supports MSI Multiple Message. The guest issues MSI configuration requests crafted to trigger the failing path inside the hypervisor's setup routine. Successful triggering corrupts the lock and enables follow-on races against MSI state. Network reachability is reflected in the CVSS vector because the malicious guest can be remotely controlled, but the trigger surface is local to the hypervisor.

No verified public proof-of-concept code is available. See the Xen Project Security Advisory 458 and the Openwall OSS Security Discussion for upstream technical details.

Detection Methods for CVE-2024-31143

Indicators of Compromise

• Unexpected Xen hypervisor crashes, hangs, or BUG() assertions referencing MSI or IRQ allocation code paths.
• Guests with PCI passthrough repeatedly attempting MSI reconfiguration or requesting unusual Multiple Message vector counts.
• Host log entries from pci_enable_msi, msi_capability_init, or related Xen IRQ subsystem functions immediately before instability.

Detection Strategies

• Inventory all Xen hosts and confirm build versions against the fixed releases listed in XSA-458.
• Monitor xl dmesg and serial console output for hypervisor warnings tied to MSI setup failures.
• Audit which guests have PCI passthrough configured, since only those domains can reach the vulnerable code path.

Monitoring Recommendations

• Forward hypervisor logs to a centralized analytics platform and alert on repeated MSI configuration errors from the same domain.
• Track guest reboots and device reset events that correlate with host stability issues.
• Validate patch levels continuously through configuration management to detect drift on Xen hosts.

How to Mitigate CVE-2024-31143

Immediate Actions Required

• Apply the patches referenced in Xen Project Security Advisory 458 to all affected Xen hypervisors.
• Restrict PCI passthrough to trusted guests until patching is complete.
• Audit guest configurations for devices that use MSI Multiple Message and reduce their privileges where possible.

Patch Information

The Xen Project has released corrected source patches through XSA-458. Distributions that ship Xen, including major Linux vendors, are issuing updated packages aligned to the advisory. Operators should rebuild or upgrade the hypervisor and reboot affected hosts to apply the fix.

Workarounds

• Disable PCI passthrough for untrusted guests until the patched hypervisor is deployed.
• Where feasible, prefer MSI-X over MSI Multiple Message for devices that support both, as MSI-X setup does not traverse the affected code path.
• Consolidate sensitive workloads onto patched hosts and isolate unpatched hosts from production guests.

# Verify the running Xen version on an affected host
xl info | grep xen_version

# Identify guests configured with PCI passthrough
for d in $(xl list --long | awk '/name/ {print $3}' | tr -d '"'); do
    echo "Domain: $d"
    xl pci-list "$d"
done