CVE-2024-21823: 
Linux Kernel vulnerability analysis and mitigation

Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may allow an authorized user to potentially enable escalation of privilege via local access. The vulnerability was discovered and disclosed in May 2024, affecting Intel Data Streaming Accelerator (Intel DSA) and Intel Analytics Accelerator (Intel IAA) V1.0 components (Intel Advisory).

The vulnerability is tracked as CVE-2024-21823 with a CVSS v3.1 base score of 7.5 (HIGH) and vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H. The issue stems from hardware logic with insecure de-synchronization between control and data channels (CWE-1264) and uncontrolled resource consumption (CWE-400) in the affected Intel processors (NVD).

When exploited, this vulnerability could allow an authorized user with local access to achieve escalation of privilege. The vulnerability specifically affects systems using Intel DSA and IAA on 4th or 5th generation Xeon processors (Intel Advisory).

The vulnerability requires local access and high attack complexity to exploit. An authorized user with low privileges and no user interaction is needed to potentially trigger the vulnerability (NVD).

Intel recommends restricting untrusted usage of Intel DSA/IAA devices on impacted processors from VM guests or 3rd party applications. The company has worked with OS vendors to provide updated kernels that disallow direct access to Intel DSA and IAA v1.0 devices by untrusted software. Additionally, several software components need to be updated, including Intel DSA Transparent Offload Library (DTO) to version 1.1 or later, OFI Libfabric Shared Memory Provider to version 1.21.1 or later, and various other Intel libraries (OSS Security).