CVE-2024-36913
Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
Reported by linux · Published May 30, 2024
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. VMBus code could free decrypted pages if set_memory_encrypted()/decrypted() fails. Leak the pages if this happens.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | f2f136c05fb6093818a3b3fefcba46231ac66a62, f2f136c05fb6093818a3b3fefcba46231ac66a62, f2f136c05fb6093818a3b3fefcba46231ac66a62 |
| Linux | Linux | 5.16, 0, 6.1.143 |
| linux | linux_kernel | 5.16, 5.16, 5.16 |
| amazon:2023 | python3-perf | 0 |
| amazon:2023 | kernel-modules-extra-common | 0 |
| amazon:2023 | kernel-headers | 0 |
| amazon:2023 | kernel-modules-extra | 0 |
| amazon:2023 | perf | 0 |
| amazon:2023 | kernel-livepatch-6.1.144-170.251 | 0 |
| amazon:2023 | kernel | 0 |
| Linux | Linux | *, 5.16, 6.6.31 |
| amazon:2023 | bpftool | 0 |
| amazon:2023 | kernel-libbpf-static | 0 |
| amazon:2023 | kernel-devel | 0 |
| amazon:2023 | kernel-tools | 0 |
| linux | linux_kernel | 1da177e4c3f4, 1da177e4c3f4, 1da177e4c3f4 |
| amazon:2023 | kernel-tools-devel | 0 |
| amazon:2023 | kernel-libbpf-devel | 0 |
| amazon:2023 | kernel-libbpf | 0 |
Timeline
- May 30, 2024 CVE Published
- May 31, 2024 EPSS Score (30 in total, the first dated here)
- Oct 4, 2024 Coalition ESS Score (27 in total, the first dated here)
- Jan 9, 2026 Security Advisory (323 in total, the first dated here)
- Mar 31, 2026 Distribution Patch (227 in total, the first dated here)
- Oct 7, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-36913
vulnetix vdb fixes CVE-2024-36913Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-36913/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart