{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-36909", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-30T15:25:07.067Z", "datePublished": "2024-05-30T15:29:08.339Z", "dateUpdated": "2026-08-05T11:31:56.472Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:31:56.472Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted\n\nIn CoCo VMs it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nThe VMBus ring buffer code could free decrypted/shared pages if\nset_memory_decrypted() fails. Check the decrypted field in the struct\nvmbus_gpadl for the ring buffers to decide whether to free the memory."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.3, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:L - The attacker is the untrusted Hyper-V host/VMM of a confidential guest, reaching the vulnerable code through the paravirtual VMBus interface (GPADL creation status, channel rescind, and the host-visibility/page-state-change hypercalls backing set_memory_encrypted()), not through any network stack. This is a local, non-network attack channel against the guest kernel, consistent with the scoring of the sibling CoCo VMBus issues.\nAC:L - The host implements the page-conversion handler and can fail set_memory_encrypted()/set_memory_decrypted() on demand every time, while independently forcing the vmbus_open()/teardown error paths via GPADL creation status, OPENCHANNEL failure or channel rescind. No race, timing window, or memory layout outside the attacker's control is involved, and the sequence is repeatable to seed many shared pages.\nPR:N - Privileges are measured against the vulnerable component \u2014 the guest kernel \u2014 and in the SEV-SNP/TDX threat model the hypervisor holds no account, credential, or capability inside the guest and sits entirely outside its authentication domain. The affected paths run automatically from driver probe/remove and channel open/close, requiring nothing from the host but its normal VMBus role.\nUI:N - The vulnerable paths execute automatically when hv_vmbus devices are probed, opened, rescinded or removed, and the host initiates the failing conversion and the teardown itself. No guest user or administrator action is required.\nS:C - Returning still-decrypted pages to the buddy allocator voids the hardware-enforced SEV-SNP/TDX memory-confidentiality boundary \u2014 a protection managed by the CPU firmware/RMP, not by the guest kernel \u2014 for memory subsequently owned by every other authority in the guest (all processes, containers, and the guest TCB). This is directly analogous to an IOMMU/DMA boundary bypass, where impact extends well beyond the VMBus driver's own security scope.\nC:H - Megabytes of ring-buffer pages that remain mapped shared to the host are recycled by the page allocator for arbitrary kernel and user allocations \u2014 slab objects, page cache, anonymous user pages, page tables, cryptographic keys \u2014 giving the host a persistent, continuously refreshed plaintext read window into confidential guest memory. That is a total break of the confidential VM's core confidentiality guarantee.\nI:H - The same recycled pages remain host-writable, so the host obtains an arbitrary-write primitive into whatever live kernel object currently occupies them (credentials, page tables, structures holding function pointers or list heads), which is leverageable for full control-flow hijack and kernel compromise inside the guest.\nA:H - Host writes into live kernel data occupying the recycled pages, combined with the private/shared encryption-state mismatch left by the aborted conversion (#VE / EPT violations or ciphertext garbage on subsequent private accesses), reliably produces guest memory corruption and kernel panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hv/channel.c"], "versions": [{"version": "d4dccf353db80e209f262e3973c834e6e48ba9a9", "lessThan": "2f622008bf784a9f5dd17baa19223cc2ac30a039", "status": "affected", "versionType": "git"}, {"version": "d4dccf353db80e209f262e3973c834e6e48ba9a9", "lessThan": "82f9e213b124a7d2bb5b16ea35d570260ef467e0", "status": "affected", "versionType": "git"}, {"version": "d4dccf353db80e209f262e3973c834e6e48ba9a9", "lessThan": "a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb", "status": "affected", "versionType": "git"}, {"version": "d4dccf353db80e209f262e3973c834e6e48ba9a9", "lessThan": "30d18df6567be09c1433e81993e35e3da573ac48", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hv/channel.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.91", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.31", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.10", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.31"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.8.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039"}, {"url": "https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0"}, {"url": "https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb"}, {"url": "https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48"}], "title": "Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-06T18:33:37.652556Z", "id": "CVE-2024-36909", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-24T15:25:16.529Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.141Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.141Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36909", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-06T18:33:37.652556Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-06T18:33:40.633Z"}}], "cna": {"title": "Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The attacker is the untrusted Hyper-V host/VMM of a confidential guest, reaching the vulnerable code through the paravirtual VMBus interface (GPADL creation status, channel rescind, and the host-visibility/page-state-change hypercalls backing set_memory_encrypted()), not through any network stack. This is a local, non-network attack channel against the guest kernel, consistent with the scoring of the sibling CoCo VMBus issues.\nAC:L - The host implements the page-conversion handler and can fail set_memory_encrypted()/set_memory_decrypted() on demand every time, while independently forcing the vmbus_open()/teardown error paths via GPADL creation status, OPENCHANNEL failure or channel rescind. No race, timing window, or memory layout outside the attacker's control is involved, and the sequence is repeatable to seed many shared pages.\nPR:N - Privileges are measured against the vulnerable component \u2014 the guest kernel \u2014 and in the SEV-SNP/TDX threat model the hypervisor holds no account, credential, or capability inside the guest and sits entirely outside its authentication domain. The affected paths run automatically from driver probe/remove and channel open/close, requiring nothing from the host but its normal VMBus role.\nUI:N - The vulnerable paths execute automatically when hv_vmbus devices are probed, opened, rescinded or removed, and the host initiates the failing conversion and the teardown itself. No guest user or administrator action is required.\nS:C - Returning still-decrypted pages to the buddy allocator voids the hardware-enforced SEV-SNP/TDX memory-confidentiality boundary \u2014 a protection managed by the CPU firmware/RMP, not by the guest kernel \u2014 for memory subsequently owned by every other authority in the guest (all processes, containers, and the guest TCB). This is directly analogous to an IOMMU/DMA boundary bypass, where impact extends well beyond the VMBus driver's own security scope.\nC:H - Megabytes of ring-buffer pages that remain mapped shared to the host are recycled by the page allocator for arbitrary kernel and user allocations \u2014 slab objects, page cache, anonymous user pages, page tables, cryptographic keys \u2014 giving the host a persistent, continuously refreshed plaintext read window into confidential guest memory. That is a total break of the confidential VM's core confidentiality guarantee.\nI:H - The same recycled pages remain host-writable, so the host obtains an arbitrary-write primitive into whatever live kernel object currently occupies them (credentials, page tables, structures holding function pointers or list heads), which is leverageable for full control-flow hijack and kernel compromise inside the guest.\nA:H - Host writes into live kernel data occupying the recycled pages, combined with the private/shared encryption-state mismatch left by the aborted conversion (#VE / EPT violations or ciphertext garbage on subsequent private accesses), reliably produces guest memory corruption and kernel panic."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9", "lessThan": "2f622008bf784a9f5dd17baa19223cc2ac30a039", "versionType": "git"}, {"status": "affected", "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9", "lessThan": "82f9e213b124a7d2bb5b16ea35d570260ef467e0", "versionType": "git"}, {"status": "affected", "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9", "lessThan": "a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb", "versionType": "git"}, {"status": "affected", "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9", "lessThan": "30d18df6567be09c1433e81993e35e3da573ac48", "versionType": "git"}], "programFiles": ["drivers/hv/channel.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"status": "unaffected", "version": "0", "lessThan": "5.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.91", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.31", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.10", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/hv/channel.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039"}, {"url": "https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0"}, {"url": "https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb"}, {"url": "https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted\n\nIn CoCo VMs it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nThe VMBus ring buffer code could free decrypted/shared pages if\nset_memory_decrypted() fails. Check the decrypted field in the struct\nvmbus_gpadl for the ring buffers to decide whether to free the memory."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.91", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.31", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.10", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "5.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:31:56.472Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36909", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:31:56.472Z", "dateReserved": "2024-05-30T15:25:07.067Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-30T15:29:08.339Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/hv/channel.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2f622008bf784a9f5dd17baa19223cc2ac30a039", "status": "affected", "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9", "versionType": "git"}, {"lessThan": "82f9e213b124a7d2bb5b16ea35d570260ef467e0", "status": "affected", "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9", "versionType": "git"}, {"lessThan": "a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb", "status": "affected", "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9", "versionType": "git"}, {"lessThan": "30d18df6567be09c1433e81993e35e3da573ac48", "status": "affected", "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/hv/channel.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.91", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.31", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C7F044DD-06F0-44B2-8185-DCA23913A970", "versionEndExcluding": "6.1.91", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CDDB1F69-36AC-41C1-9192-E7CCEF5FFC00", "versionEndExcluding": "6.6.31", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A6B920C-8D8F-4130-86B4-AD334F4CF2E3", "versionEndExcluding": "6.8.10", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*", "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*", "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted\n\nIn CoCo VMs it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nThe VMBus ring buffer code could free decrypted/shared pages if\nset_memory_decrypted() fails. Check the decrypted field in the struct\nvmbus_gpadl for the ring buffers to decide whether to free the memory."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Controladores: hv: vmbus: no liberar b\u00faferes de anillo que no se pudieron volver a cifrar. En las m\u00e1quinas virtuales CoCo, es posible que el host que no es de confianza cause set_memory_encrypted() o set_memory_decrypted( ) falle de modo que se devuelva un error y se comparta la memoria resultante. Las personas que llaman deben tener cuidado al manejar estos errores para evitar devolver memoria descifrada (compartida) al asignador de p\u00e1ginas, lo que podr\u00eda provocar problemas funcionales o de seguridad. El c\u00f3digo del buffer circular de VMBus podr\u00eda liberar p\u00e1ginas descifradas/compartidas si falla set_memory_decrypted(). Verifique el campo descifrado en la estructura vmbus_gpadl para ver los b\u00faferes en anillo para decidir si liberar la memoria."}], "id": "CVE-2024-36909", "lastModified": "2026-08-04T11:18:29.040", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-36909", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-06-06T18:33:37.652556Z", "version": "2.0.3"}}]}, "published": "2024-05-30T16:15:14.380", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted", "id": "2284615", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2284615"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nDrivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted\nIn CoCo VMs it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\nThe VMBus ring buffer code could free decrypted/shared pages if\nset_memory_decrypted() fails. Check the decrypted field in the struct\nvmbus_gpadl for the ring buffers to decide whether to free the memory."], "name": "CVE-2024-36909", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-36909\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-36909"], "threat_severity": "Low"}