CVE-2024-45819

What it actually does

The vulnerability allows PVH guests to read residual data from the hypervisor's local memory used during ACPI table construction, as unused portions retain prior contents instead of being zeroed.

Why it matters to the business

Attackers with access to a virtual machine could potentially access sensitive information from the host system, leading to data breaches or further attacks on the virtualization infrastructure.

How an attack unfolds

An attacker running a PVH guest VM inspects the ACPI tables provided by the hypervisor toolstack and extracts any leftover data from previous memory allocations that was not cleared.

How to fix it

Update to a fixed version of the hypervisor that properly initializes or clears excess memory during ACPI table construction for PVH guests.

How to confirm the fix worked

After applying updates, create new PVH guests and verify that ACPI tables contain only intended data with no residual contents from prior allocations.

Typical attack path

1. Gain control of a PVH guest virtual machine
2. Access the ACPI tables in guest memory
3. Scan for and extract residual sensitive data from uninitialized memory regions

How to detect it

Examine hypervisor and guest creation logs for PVH instances, then inspect provided ACPI tables or guest memory for patterns of uninitialized residual data.

What your security team should do

• Apply hypervisor patches to address memory initialization in ACPI construction
• Audit virtualization configurations to restrict PVH guest usage where possible
• Monitor guest memory access patterns for signs of unexpected data exposure