CVE-2024-38632

What it actually does

Potential memory leak of the 'name' string in vfio_intx_enable() when vfio_irq_ctx_alloc() fails, allowing repeated allocation failures to exhaust kernel memory in VFIO PCI interrupt handling paths.

Why it matters to the business

Over time, systems using VFIO for device passthrough may experience gradual memory exhaustion, leading to performance degradation, service instability, or kernel crashes in virtualized or high-availability Linux environments; low immediate urgency given stable low EPSS and lack of KEV listing despite broad Linux kernel prevalence.

How an attack unfolds

An attacker with local access or ability to trigger VFIO PCI interrupt setup repeatedly induces failure in vfio_irq_ctx_alloc() to leak kernel memory allocations of the device name string; listed threat actors in espionage and financial campaigns could chain this with other kernel issues for resource exhaustion but no public exploits or ransomware use noted.

How to fix it

Update Linux kernel to version 5.15.168 or later, or apply the fix commit a6d810554d7d9d07041f14c5fcd453f3d3fed594 in affected stable trees; rebuild and deploy custom kernels where distribution packages lag.

How to confirm the fix worked

Verify running kernel version is at or above 5.15.168; inspect vfio/pci.c source for the resolved allocation error handling in vfio_intx_enable(); monitor kernel memory usage under VFIO workloads post-upgrade.

Typical attack path

1. Gain local execution or control over VFIO device attachment on target Linux kernel
2. Repeatedly invoke or force failure paths in vfio_intx_enable() via crafted VFIO ioctl or device operations
3. Trigger vfio_irq_ctx_alloc() failures to accumulate leaked 'name' allocations
4. Monitor for kernel memory pressure or OOM conditions to amplify denial of service

How to detect it

Review kernel logs for repeated VFIO interrupt allocation failures; correlate with memory usage spikes in processes using VFIO; examine dmesg or /proc/meminfo for unexplained growth tied to vfio_pci; check for threat actor patterns involving Linux kernel resource issues.

What your security team should do

• Prioritize kernel upgrades on all systems exposing VFIO PCI interfaces within the next maintenance window
• Audit VFIO usage and restrict device passthrough privileges to least-privilege contexts
• Enable kernel memory accounting and OOM monitoring to detect anomalous leaks
• Track EPSS and threat actor reports for any rise in exploit maturity