{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-36912","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-05-30T15:25:07.067Z","datePublished":"2024-05-30T15:29:10.454Z","dateUpdated":"2026-08-05T11:31:59.694Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:31:59.694Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Track decrypted status in vmbus_gpadl\n\nIn CoCo VMs it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nIn order to make sure callers of vmbus_establish_gpadl() and\nvmbus_teardown_gpadl() don't return decrypted/shared pages to\nallocators, add a field in struct vmbus_gpadl to keep track of the\ndecryption status of the buffers. This will allow the callers to\nknow if they should free or leak the pages."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:A - The attacker is the untrusted Hyper-V host/paravisor, which reaches the guest only through the VMBus channel and page-visibility hypercall interface — a logically adjacent, non-routable host↔guest topology, not an internet-routable path. The attacker holds no console, shell, or account on the guest, so this is not a locally-accessed attack.\nAC:L - The host deterministically controls the outcome by returning a failure status from `HVCALL_MODIFY_SPARSE_GPA_PAGE_HOST_VISIBILITY`, and it also controls when GPADLs are established and torn down via channel offer/rescind, so it can repeat the cycle at will. No race, no memory layout it cannot influence, and no condition outside its control is involved.\nPR:N - The vulnerable component is the confidential guest kernel, in which the malicious host is by design an unprivileged, untrusted entity — the whole point of SEV-SNP/TDX is that the VMM has no rights over guest memory. Exploitation requires no guest credential, capability, or account whatsoever.\nUI:N - The host triggers the establish/teardown paths itself through channel rescind/re-offer and NVSP buffer negotiation, and netvsc/uio_hv_generic probe and removal run automatically. No guest administrator or user action is needed.\nS:C - The failure defeats the hardware/firmware-enforced confidential-computing memory boundary (SEV-SNP RMP / TDX module), a security authority distinct from the guest OS, letting the VMM access memory the platform was supposed to keep private — directly analogous to an IOMMU/DMA boundary bypass. Impact therefore extends beyond the guest kernel's own security scope.\nC:H - Shared pages returned to the buddy allocator are reused for arbitrary guest kernel and userspace memory while the VMM still maps their shared alias in the EPT/NPT, giving it plaintext read of whatever lands there — keys, credentials, and application data. That is a total loss of the confidential VM's confidentiality guarantee.\nI:H - The shared alias is writable by the VMM, so the host can modify guest memory that has been reallocated for page tables, task structs, or page-cache-backed code, yielding an arbitrary kernel write and control-flow hijack primitive inside the guest. The host can additionally groom placement by repeatedly forcing multi-megabyte netvsc buffers through the leak.\nA:H - Reusing pages whose actual shared/private state disagrees with the guest PTE causes data corruption and faults, and the host can unmap or alter the shared backing to crash the guest; on TDX/SNP such state mismatches escalate to fatal guest errors. The WARN added in the same series also panics guests configured with `panic_on_warn`."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hv/channel.c","include/linux/hyperv.h"],"versions":[{"version":"d4dccf353db80e209f262e3973c834e6e48ba9a9","lessThan":"1999644d95194d4a58d3e80ad04ce19220a01a81","status":"affected","versionType":"git"},{"version":"d4dccf353db80e209f262e3973c834e6e48ba9a9","lessThan":"8e62341f5c45b27519b7d193bcc32ada416ad9d8","status":"affected","versionType":"git"},{"version":"d4dccf353db80e209f262e3973c834e6e48ba9a9","lessThan":"bfae56be077ba14311509e70706a13458f87ea99","status":"affected","versionType":"git"},{"version":"d4dccf353db80e209f262e3973c834e6e48ba9a9","lessThan":"211f514ebf1ef5de37b1cf6df9d28a56cfd242ca","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/hv/channel.c","include/linux/hyperv.h"],"versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","status":"unaffected","versionType":"semver"},{"version":"6.1.91","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.31","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.8.10","lessThanOrEqual":"6.8.*","status":"unaffected","versionType":"semver"},{"version":"6.9","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.91"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.6.31"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.8.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.9"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/1999644d95194d4a58d3e80ad04ce19220a01a81"},{"url":"https://git.kernel.org/stable/c/8e62341f5c45b27519b7d193bcc32ada416ad9d8"},{"url":"https://git.kernel.org/stable/c/bfae56be077ba14311509e70706a13458f87ea99"},{"url":"https://git.kernel.org/stable/c/211f514ebf1ef5de37b1cf6df9d28a56cfd242ca"}],"title":"Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-1258","lang":"en","description":"CWE-1258 Exposure of Sensitive System Information Due to Uncleared Debug Information"}]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-06-05T14:45:02.277532Z","id":"CVE-2024-36912","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-05T14:45:05.691Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T03:43:50.056Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/1999644d95194d4a58d3e80ad04ce19220a01a81","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/8e62341f5c45b27519b7d193bcc32ada416ad9d8","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/bfae56be077ba14311509e70706a13458f87ea99","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/211f514ebf1ef5de37b1cf6df9d28a56cfd242ca","tags":["x_transferred"]}]}]}}