CVE-2024-45817

mediumpriority · track · 0EPSS 0.005 · 46 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.54% (46th) EPSS

CVSS 6.5 · medium

Is it mine?

13 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions are reported in a status register. Furthermore, the OS can opt to receive an interrupt when a new error occurs. It is possible to configure the error interrupt with an illegal vector, which generates an error when an error interrupt is raised. This case causes Xen to recurse through vlapic_error(). The recursion itself is bounded; errors accumulate in the the status register and only generate an interrupt when a new status bit becomes set. However, the lock protecting this state in Xen will try to be taken recursively, and deadlock.

cvss

Technical severity, 0–10. One row per scoring source.

7.3

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–7.3

v3.16.5mediumAV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · ENISA EU

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondaryexploitability 3.9 · impact 3.4

v3.16.7mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-209USCWE-833US

affected products (13)

Products and version ranges known to be affected.

Citrix Systems Hypervisor <=8.2 CU1 LTSRall versionscert_bundDE
Citrix Systems XenServer <=8all versionscert_bundDE
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
Open Source Xen <xsa462.patchall versionscert_bundDE
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Citrix Systems Hypervisor≤ 8.2 CU1 LTSRcert_bundDE
Citrix Systems XenServer≤ 8cert_bundDE
Open Source Xen< xsa462.patchcert_bundDE
The Linux Foundation Xen≥ 4.5fstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 2.14fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
xen xen≥ 4.5.0nvdUScpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-2209XEN, Citrix XenServer und Hypervisor: Schwachstelle ermöglicht Denial of ServiceDeutsch2024-09-24csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in XEN, Citrix XenServer und Citrix Systems Hypervisor ausnutzen, um einen Denial of Service Angriff durchzuführen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd NVD CVE.org MITRE

published 2024-09-25modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

https://cxsecurity.com/cveshow/CVE-2024-45817/cnnvd
https://nvd.nist.gov/vuln/detail/CVE-2024-45817 cnnvd
https://vigilance.fr/vulnerability/Xen-denial-of-service-via-vlapic-error-45207 cnnvd
https://xenbits.xenproject.org/xsa/advisory-462.html cnnvd
https://xenbits.xenproject.org/xsa/advisory-462.html enisa_euvd
http://www.openwall.com/lists/oss-security/2024/09/24/1Mailing ListThird Party Advisorynvd
http://xenbits.xen.org/xsa/advisory-462.htmlPatchVendor Advisorynvd
https://xenbits.xenproject.org/xsa/advisory-462.htmlPatchVendor Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan