CVE-2024-31146

What it actually does

The flaw permits configurations in which devices sharing PCI Base Address Registers or INTx interrupt lines are passed through to a guest, preventing any security guarantee for the host or other guests without detailed knowledge of all involved guest internals.

Why it matters to the business

Organizations running virtualized environments with device passthrough face elevated risk of cross-guest or host compromise, increasing operational exposure until configurations are corrected or software is updated.

How an attack unfolds

An attacker identifies or configures a system with multiple devices sharing problematic resources, arranges passthrough of one device to a controlled or compromised guest, then leverages the shared hardware mapping to perform side-channel or interrupt-based attacks against other guests or the host.

How to fix it

Update github.com/grafana/grafana to one of the fixed versions 8.5.22, 9.2.15, 9.3.11, or 9.4.7. Avoid device passthrough configurations involving shared PCI BARs or INTx lines; disable or isolate such setups where possible.

How to confirm the fix worked

Confirm the installed version matches a listed fixed release; audit virtualization or device configuration files for any passthrough of devices known to share BAR pages or interrupt lines.

Typical attack path

1. Locate or create a setup where multiple devices map to the same page via BARs or share INTx lines
2. Pass one affected device through to a guest under attacker control
3. Exploit the shared resource from within the guest to observe or influence other guests or the hypervisor

How to detect it

Inspect hypervisor or virtualization logs for device passthrough events involving multiple devices; look for configuration artifacts that map shared BARs or INTx lines to guests.

What your security team should do

• Apply the listed fixed versions immediately given the published date and ecosystem reach
• Review and disable any device passthrough setups that involve shared resources until verified safe
• Add configuration scanning to detect future shared-resource passthrough attempts