CVE-2024-36909

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36909
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. The VMBus ring buffer code could free decrypted/shared pages if set_memory_decrypted() fails. Check the decrypted field in the struct vmbus_gpadl for the ring buffers to decide whether to free the memory.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039 Patch
https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48 Patch
https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0 Patch
https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb Patch
https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039 Patch
https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48 Patch
https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0 Patch
https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
History

30 Sep 2025, 17:54

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039 - () https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039 - Patch
References () https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48 - () https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48 - Patch
References () https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0 - () https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0 - Patch
References () https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb - () https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb - Patch
CWE CWE-401
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

21 Nov 2024, 09:22

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Controladores: hv: vmbus: no liberar búferes de anillo que no se pudieron volver a cifrar. En las máquinas virtuales CoCo, es posible que el host que no es de confianza cause set_memory_encrypted() o set_memory_decrypted( ) falle de modo que se devuelva un error y se comparta la memoria resultante. Las personas que llaman deben tener cuidado al manejar estos errores para evitar devolver memoria descifrada (compartida) al asignador de páginas, lo que podría provocar problemas funcionales o de seguridad. El código del buffer circular de VMBus podría liberar páginas descifradas/compartidas si falla set_memory_decrypted(). Verifique el campo descifrado en la estructura vmbus_gpadl para ver los búferes en anillo para decidir si liberar la memoria.
References () https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039 - () https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039 -
References () https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48 - () https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48 -
References () https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0 - () https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0 -
References () https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb - () https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb -

30 May 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-30 16:15

Updated : 2025-09-30 17:54

NVD link : CVE-2024-36909

Mitre link : CVE-2024-36909

CVE.ORG link : CVE-2024-36909

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime