CVE-2024-36912 (GCVE-0-2024-36912)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:29 – Updated: 2026-08-05 11:31
VLAI
Title
Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
Summary
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. In order to make sure callers of vmbus_establish_gpadl() and vmbus_teardown_gpadl() don't return decrypted/shared pages to allocators, add a field in struct vmbus_gpadl to keep track of the decryption status of the buffers. This will allow the callers to know if they should free or leak the pages.
Severity
9.6 (Critical)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-05 14:45 UTC
CWE
  • CWE-1258 - Exposure of Sensitive System Information Due to Uncleared Debug Information
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d4dccf353db80e209f262e3973c834e6e48ba9a9 , < 1999644d95194d4a58d3e80ad04ce19220a01a81 (git)
Affected: d4dccf353db80e209f262e3973c834e6e48ba9a9 , < 8e62341f5c45b27519b7d193bcc32ada416ad9d8 (git)
Affected: d4dccf353db80e209f262e3973c834e6e48ba9a9 , < bfae56be077ba14311509e70706a13458f87ea99 (git)
Affected: d4dccf353db80e209f262e3973c834e6e48ba9a9 , < 211f514ebf1ef5de37b1cf6df9d28a56cfd242ca (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.1.91 , ≤ 6.1.* (semver)
Unaffected: 6.6.31 , ≤ 6.6.* (semver)
Unaffected: 6.8.10 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-36912",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-05T14:45:02.277532Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1258",
                "description": "CWE-1258 Exposure of Sensitive System Information Due to Uncleared Debug Information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-05T14:45:05.691Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.056Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1999644d95194d4a58d3e80ad04ce19220a01a81"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8e62341f5c45b27519b7d193bcc32ada416ad9d8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bfae56be077ba14311509e70706a13458f87ea99"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/211f514ebf1ef5de37b1cf6df9d28a56cfd242ca"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hv/channel.c",
            "include/linux/hyperv.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1999644d95194d4a58d3e80ad04ce19220a01a81",
              "status": "affected",
              "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9",
              "versionType": "git"
            },
            {
              "lessThan": "8e62341f5c45b27519b7d193bcc32ada416ad9d8",
              "status": "affected",
              "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9",
              "versionType": "git"
            },
            {
              "lessThan": "bfae56be077ba14311509e70706a13458f87ea99",
              "status": "affected",
              "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9",
              "versionType": "git"
            },
            {
              "lessThan": "211f514ebf1ef5de37b1cf6df9d28a56cfd242ca",
              "status": "affected",
              "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hv/channel.c",
            "include/linux/hyperv.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.91",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.31",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Track decrypted status in vmbus_gpadl\n\nIn CoCo VMs it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nIn order to make sure callers of vmbus_establish_gpadl() and\nvmbus_teardown_gpadl() don\u0027t return decrypted/shared pages to\nallocators, add a field in struct vmbus_gpadl to keep track of the\ndecryption status of the buffers. This will allow the callers to\nknow if they should free or leak the pages."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The attacker is the untrusted Hyper-V host/paravisor, which reaches the guest only through the VMBus channel and page-visibility hypercall interface \u2014 a logically adjacent, non-routable host\u2194guest topology, not an internet-routable path. The attacker holds no console, shell, or account on the guest, so this is not a locally-accessed attack.\nAC:L - The host deterministically controls the outcome by returning a failure status from `HVCALL_MODIFY_SPARSE_GPA_PAGE_HOST_VISIBILITY`, and it also controls when GPADLs are established and torn down via channel offer/rescind, so it can repeat the cycle at will. No race, no memory layout it cannot influence, and no condition outside its control is involved.\nPR:N - The vulnerable component is the confidential guest kernel, in which the malicious host is by design an unprivileged, untrusted entity \u2014 the whole point of SEV-SNP/TDX is that the VMM has no rights over guest memory. Exploitation requires no guest credential, capability, or account whatsoever.\nUI:N - The host triggers the establish/teardown paths itself through channel rescind/re-offer and NVSP buffer negotiation, and netvsc/uio_hv_generic probe and removal run automatically. No guest administrator or user action is needed.\nS:C - The failure defeats the hardware/firmware-enforced confidential-computing memory boundary (SEV-SNP RMP / TDX module), a security authority distinct from the guest OS, letting the VMM access memory the platform was supposed to keep private \u2014 directly analogous to an IOMMU/DMA boundary bypass. Impact therefore extends beyond the guest kernel\u0027s own security scope.\nC:H - Shared pages returned to the buddy allocator are reused for arbitrary guest kernel and userspace memory while the VMM still maps their shared alias in the EPT/NPT, giving it plaintext read of whatever lands there \u2014 keys, credentials, and application data. That is a total loss of the confidential VM\u0027s confidentiality guarantee.\nI:H - The shared alias is writable by the VMM, so the host can modify guest memory that has been reallocated for page tables, task structs, or page-cache-backed code, yielding an arbitrary kernel write and control-flow hijack primitive inside the guest. The host can additionally groom placement by repeatedly forcing multi-megabyte netvsc buffers through the leak.\nA:H - Reusing pages whose actual shared/private state disagrees with the guest PTE causes data corruption and faults, and the host can unmap or alter the shared backing to crash the guest; on TDX/SNP such state mismatches escalate to fatal guest errors. The WARN added in the same series also panics guests configured with `panic_on_warn`."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:59.694Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1999644d95194d4a58d3e80ad04ce19220a01a81"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e62341f5c45b27519b7d193bcc32ada416ad9d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfae56be077ba14311509e70706a13458f87ea99"
        },
        {
          "url": "https://git.kernel.org/stable/c/211f514ebf1ef5de37b1cf6df9d28a56cfd242ca"
        }
      ],
      "title": "Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36912",
    "datePublished": "2024-05-30T15:29:10.454Z",
    "dateReserved": "2024-05-30T15:25:07.067Z",
    "dateUpdated": "2026-08-05T11:31:59.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36912",
      "date": "2026-10-06",
      "epss": "0.00965",
      "percentile": "0.60436"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Track decrypted status in vmbus_gpadl\n\nIn CoCo VMs it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nIn order to make sure callers of vmbus_establish_gpadl() and\nvmbus_teardown_gpadl() don\u0027t return decrypted/shared pages to\nallocators, add a field in struct vmbus_gpadl to keep track of the\ndecryption status of the buffers. This will allow the callers to\nknow if they should free or leak the pages."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Controladores: hv: vmbus: Seguimiento del estado descifrado en vmbus_gpadl En m\u00e1quinas virtuales CoCo, es posible que el host que no es de confianza provoque que set_memory_encrypted() o set_memory_decrypted() falle de manera que se devuelva un error y la memoria resultante se comparte. Las personas que llaman deben tener cuidado al manejar estos errores para evitar devolver memoria descifrada (compartida) al asignador de p\u00e1ginas, lo que podr\u00eda provocar problemas funcionales o de seguridad. Para asegurarse de que las personas que llaman a vmbus_establish_gpadl() y vmbus_teardown_gpadl() no devuelvan p\u00e1ginas descifradas/compartidas a los asignadores, agregue un campo en la estructura vmbus_gpadl para realizar un seguimiento del estado de descifrado de los b\u00faferes. Esto permitir\u00e1 a quienes llaman saber si deben liberar o filtrar las p\u00e1ginas."
        }
      ],
      "id": "CVE-2024-36912",
      "lastModified": "2024-11-21T09:22:48.010",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 2.2,
            "impactScore": 5.9,
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-05-30T16:15:14.607",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/1999644d95194d4a58d3e80ad04ce19220a01a81"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/211f514ebf1ef5de37b1cf6df9d28a56cfd242ca"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/8e62341f5c45b27519b7d193bcc32ada416ad9d8"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/bfae56be077ba14311509e70706a13458f87ea99"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/1999644d95194d4a58d3e80ad04ce19220a01a81"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/211f514ebf1ef5de37b1cf6df9d28a56cfd242ca"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/8e62341f5c45b27519b7d193bcc32ada416ad9d8"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/bfae56be077ba14311509e70706a13458f87ea99"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-1258"
            }
          ],
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ]
    },
    "microsoft_vex": {
      "current_release_date": "2025-09-03T22:00:05.000Z",
      "cve": "CVE-2024-36912",
      "id": "msrc_CVE-2024-36912",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-36912.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hv/channel.c",
                  "include/linux/hyperv.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1999644d95194d4a58d3e80ad04ce19220a01a81",
                    "status": "affected",
                    "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8e62341f5c45b27519b7d193bcc32ada416ad9d8",
                    "status": "affected",
                    "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bfae56be077ba14311509e70706a13458f87ea99",
                    "status": "affected",
                    "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "211f514ebf1ef5de37b1cf6df9d28a56cfd242ca",
                    "status": "affected",
                    "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hv/channel.c",
                  "include/linux/hyperv.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.16"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.91",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.31",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.8.*",
                    "status": "unaffected",
                    "version": "6.8.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.9",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4F8C886C-75AA-469B-A6A9-12BF1A29C0D5",
                    "versionEndExcluding": "6.1.91",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CDDB1F69-36AC-41C1-9192-E7CCEF5FFC00",
                    "versionEndExcluding": "6.6.31",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6A6B920C-8D8F-4130-86B4-AD334F4CF2E3",
                    "versionEndExcluding": "6.8.10",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Track decrypted status in vmbus_gpadl\n\nIn CoCo VMs it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nIn order to make sure callers of vmbus_establish_gpadl() and\nvmbus_teardown_gpadl() don\u0027t return decrypted/shared pages to\nallocators, add a field in struct vmbus_gpadl to keep track of the\ndecryption status of the buffers. This will allow the callers to\nknow if they should free or leak the pages."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Controladores: hv: vmbus: Seguimiento del estado descifrado en vmbus_gpadl En m\u00e1quinas virtuales CoCo, es posible que el host que no es de confianza provoque que set_memory_encrypted() o set_memory_decrypted() falle de manera que se devuelva un error y la memoria resultante se comparte. Las personas que llaman deben tener cuidado al manejar estos errores para evitar devolver memoria descifrada (compartida) al asignador de p\u00e1ginas, lo que podr\u00eda provocar problemas funcionales o de seguridad. Para asegurarse de que las personas que llaman a vmbus_establish_gpadl() y vmbus_teardown_gpadl() no devuelvan p\u00e1ginas descifradas/compartidas a los asignadores, agregue un campo en la estructura vmbus_gpadl para realizar un seguimiento del estado de descifrado de los b\u00faferes. Esto permitir\u00e1 a quienes llaman saber si deben liberar o filtrar las p\u00e1ginas."
          }
        ],
        "id": "CVE-2024-36912",
        "lastModified": "2026-08-04T11:18:30.030",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.6,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-36912",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-05T14:45:02.277532Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-30T16:15:14.607",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1999644d95194d4a58d3e80ad04ce19220a01a81"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/211f514ebf1ef5de37b1cf6df9d28a56cfd242ca"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8e62341f5c45b27519b7d193bcc32ada416ad9d8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bfae56be077ba14311509e70706a13458f87ea99"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1999644d95194d4a58d3e80ad04ce19220a01a81"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/211f514ebf1ef5de37b1cf6df9d28a56cfd242ca"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8e62341f5c45b27519b7d193bcc32ada416ad9d8"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bfae56be077ba14311509e70706a13458f87ea99"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-1258"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T14:44:28+00:00",
      "cve": "CVE-2024-36912",
      "id": "CVE-2024-36912",
      "initial_release_date": "2024-05-30T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36912.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-05T00:43:40Z",
      "cve": "CVE-2024-36912",
      "id": "CVE-2024-36912",
      "initial_release_date": "2024-06-01T02:23:20Z",
      "product_status:known_affected": "397",
      "product_status:known_not_affected": "237",
      "product_status:recommended": "651",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-36912",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-36912.json",
      "version": "81"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T03:43:50.056Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/1999644d95194d4a58d3e80ad04ce19220a01a81"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/8e62341f5c45b27519b7d193bcc32ada416ad9d8"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/bfae56be077ba14311509e70706a13458f87ea99"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/211f514ebf1ef5de37b1cf6df9d28a56cfd242ca"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "HIGH",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "HIGH",
                  "baseScore": 8.1,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-36912",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-06-05T14:45:02.277532Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-1258",
                    "description": "CWE-1258 Exposure of Sensitive System Information Due to Uncleared Debug Information",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-06-05T14:41:07.551Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/hv/channel.c",
                "include/linux/hyperv.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "1999644d95194d4a58d3e80ad04ce19220a01a81",
                  "status": "affected",
                  "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9",
                  "versionType": "git"
                },
                {
                  "lessThan": "8e62341f5c45b27519b7d193bcc32ada416ad9d8",
                  "status": "affected",
                  "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9",
                  "versionType": "git"
                },
                {
                  "lessThan": "bfae56be077ba14311509e70706a13458f87ea99",
                  "status": "affected",
                  "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9",
                  "versionType": "git"
                },
                {
                  "lessThan": "211f514ebf1ef5de37b1cf6df9d28a56cfd242ca",
                  "status": "affected",
                  "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/hv/channel.c",
                "include/linux/hyperv.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.16"
                },
                {
                  "lessThan": "5.16",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.91",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.31",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.8.*",
                  "status": "unaffected",
                  "version": "6.8.10",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.9",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.91",
                      "versionStartIncluding": "5.16",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.31",
                      "versionStartIncluding": "5.16",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8.10",
                      "versionStartIncluding": "5.16",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.9",
                      "versionStartIncluding": "5.16",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Track decrypted status in vmbus_gpadl\n\nIn CoCo VMs it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nIn order to make sure callers of vmbus_establish_gpadl() and\nvmbus_teardown_gpadl() don\u0027t return decrypted/shared pages to\nallocators, add a field in struct vmbus_gpadl to keep track of the\ndecryption status of the buffers. This will allow the callers to\nknow if they should free or leak the pages."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 9.6,
                "baseSeverity": "CRITICAL",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:A - The attacker is the untrusted Hyper-V host/paravisor, which reaches the guest only through the VMBus channel and page-visibility hypercall interface \u2014 a logically adjacent, non-routable host\u2194guest topology, not an internet-routable path. The attacker holds no console, shell, or account on the guest, so this is not a locally-accessed attack.\nAC:L - The host deterministically controls the outcome by returning a failure status from `HVCALL_MODIFY_SPARSE_GPA_PAGE_HOST_VISIBILITY`, and it also controls when GPADLs are established and torn down via channel offer/rescind, so it can repeat the cycle at will. No race, no memory layout it cannot influence, and no condition outside its control is involved.\nPR:N - The vulnerable component is the confidential guest kernel, in which the malicious host is by design an unprivileged, untrusted entity \u2014 the whole point of SEV-SNP/TDX is that the VMM has no rights over guest memory. Exploitation requires no guest credential, capability, or account whatsoever.\nUI:N - The host triggers the establish/teardown paths itself through channel rescind/re-offer and NVSP buffer negotiation, and netvsc/uio_hv_generic probe and removal run automatically. No guest administrator or user action is needed.\nS:C - The failure defeats the hardware/firmware-enforced confidential-computing memory boundary (SEV-SNP RMP / TDX module), a security authority distinct from the guest OS, letting the VMM access memory the platform was supposed to keep private \u2014 directly analogous to an IOMMU/DMA boundary bypass. Impact therefore extends beyond the guest kernel\u0027s own security scope.\nC:H - Shared pages returned to the buddy allocator are reused for arbitrary guest kernel and userspace memory while the VMM still maps their shared alias in the EPT/NPT, giving it plaintext read of whatever lands there \u2014 keys, credentials, and application data. That is a total loss of the confidential VM\u0027s confidentiality guarantee.\nI:H - The shared alias is writable by the VMM, so the host can modify guest memory that has been reallocated for page tables, task structs, or page-cache-backed code, yielding an arbitrary kernel write and control-flow hijack primitive inside the guest. The host can additionally groom placement by repeatedly forcing multi-megabyte netvsc buffers through the leak.\nA:H - Reusing pages whose actual shared/private state disagrees with the guest PTE causes data corruption and faults, and the host can unmap or alter the shared backing to crash the guest; on TDX/SNP such state mismatches escalate to fatal guest errors. The WARN added in the same series also panics guests configured with `panic_on_warn`."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:31:59.694Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/1999644d95194d4a58d3e80ad04ce19220a01a81"
            },
            {
              "url": "https://git.kernel.org/stable/c/8e62341f5c45b27519b7d193bcc32ada416ad9d8"
            },
            {
              "url": "https://git.kernel.org/stable/c/bfae56be077ba14311509e70706a13458f87ea99"
            },
            {
              "url": "https://git.kernel.org/stable/c/211f514ebf1ef5de37b1cf6df9d28a56cfd242ca"
            }
          ],
          "title": "Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-36912",
        "datePublished": "2024-05-30T15:29:10.454Z",
        "dateReserved": "2024-05-30T15:25:07.067Z",
        "dateUpdated": "2026-08-05T11:31:59.694Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.