CVE-2024-21963: 
Linux Kernel 취약점 분석 및 완화

CVE-2024-21963 is an out-of-bounds device table fetch vulnerability in AMD IOMMU affecting CPU families from Zen1/Zen2 through Zen5/BRH. When the IOMMU device-table size is not forced to the maximum (2MB), a guest can trigger malicious table walks that corrupt hypervisor-owned pages and/or crash the system. The vulnerability was disclosed in November 2026 and carries a CVSS v3.1 base score of 6.3 (Medium) (Oracle Linux, AMD Advisory).

The root cause is an out-of-bounds read (CWE-125) in AMD's IOMMU hardware when the device table is configured with a size smaller than the maximum 2MB. A malicious guest can craft device table walks that exceed the configured table boundary, causing the IOMMU to fetch entries from hypervisor-owned memory regions outside the intended table. This maps to CAPEC-540 (Overread Buffers) and requires the attacker to have guest-level access in a virtualized environment where the hypervisor has not enforced the maximum device-table size (AMD Advisory, Oracle Linux).

Successful exploitation can result in corruption of hypervisor-owned memory pages or a system crash, impacting availability and potentially integrity of the host system. The scope is changed (S:C), meaning the impact extends beyond the guest VM to the hypervisor layer, which could affect all co-hosted virtual machines. Confidentiality impact is assessed as none, but the ability to corrupt hypervisor memory introduces a risk of privilege escalation or denial of service across the entire virtualized environment (Oracle Linux, AMD Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2024-21963 as of the time of disclosure. The attack vector is network-accessible (AV:N) with high complexity (AC:H) and requires low privileges (PR:L), meaning a guest with some level of access in a virtualized environment is needed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no threat actor attribution has been identified (AMD Advisory, Oracle Linux).

AMD's advisory identifies that setting the IOMMU device-table size to the maximum (2MB) mitigates the vulnerability by preventing out-of-bounds table walks. Oracle Linux has released kernel-uek errata (ELSA-2026-500587, ELSA-2026-500588, ELSA-2026-500590) for Oracle Linux 9 on November 9, 2026, addressing this issue. Administrators running affected AMD Zen1 through Zen5/BRH platforms in virtualized environments should apply the relevant kernel updates and verify IOMMU device-table configuration (Oracle Linux, AMD Advisory).