CVE-2024-31145

What it actually does

Flawed error handling during setup of Reserved Memory Region (RMRR) or Unity Mapping ranges for PCI devices leaves mappings active after they should have been torn down, granting guest VMs unauthorized access to host memory regions.

Why it matters to the business

Compromised memory isolation in virtualized environments can expose sensitive data or allow privilege escalation across guest boundaries, increasing risk of breaches in multi-tenant or cloud infrastructure.

How an attack unfolds

An attacker with a guest VM that controls a PCI device tied to an RMRR region triggers the flawed mapping logic during device activation; an error condition leaves the mapping in place, after which the guest reads or writes the reserved host memory it should not reach.

How to fix it

Apply the latest hypervisor patches that correct error handling for RMRR and Unity Mapping teardown; verify all affected virtualization software is updated to a version containing the memory-mapping fix.

How to confirm the fix worked

After patching, confirm via hypervisor configuration review and memory-access tests that mappings for RMRR regions are correctly removed when devices are deactivated or guests are shut down.

Typical attack path

1. Identify or attach a PCI device associated with an RMRR or Unity Mapping range
2. Activate the device to force mapping establishment
3. Induce an error path in the mapping logic
4. Retain persistent unauthorized mappings
5. Access or exfiltrate host memory contents from the guest

How to detect it

Review hypervisor and IOMMU logs for repeated mapping setup errors or unexpected retention of RMRR mappings associated with PCI devices; correlate with guest activity on assigned devices.

What your security team should do

• Prioritize patching of all hypervisors handling PCI passthrough or device assignment
• Audit VM configurations that use direct PCI device assignment
• Disable unnecessary legacy USB emulation or RMRR-dependent features where possible
• Monitor vendor advisories for the specific fixed versions once released