CVE-2024-36909 (GCVE-0-2024-36909)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:29 – Updated: 2026-08-05 11:31
VLAI
Title
Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
Summary
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. The VMBus ring buffer code could free decrypted/shared pages if set_memory_decrypted() fails. Check the decrypted field in the struct vmbus_gpadl for the ring buffers to decide whether to free the memory.
Severity
9.3 (Critical)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d4dccf353db80e209f262e3973c834e6e48ba9a9 , < 2f622008bf784a9f5dd17baa19223cc2ac30a039 (git)
Affected: d4dccf353db80e209f262e3973c834e6e48ba9a9 , < 82f9e213b124a7d2bb5b16ea35d570260ef467e0 (git)
Affected: d4dccf353db80e209f262e3973c834e6e48ba9a9 , < a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb (git)
Affected: d4dccf353db80e209f262e3973c834e6e48ba9a9 , < 30d18df6567be09c1433e81993e35e3da573ac48 (git)
Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.1.91 , ≤ 6.1.* (semver)
Unaffected: 6.6.31 , ≤ 6.6.* (semver)
Unaffected: 6.8.10 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36909",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-06T18:33:37.652556Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-24T15:25:16.529Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.141Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hv/channel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2f622008bf784a9f5dd17baa19223cc2ac30a039",
              "status": "affected",
              "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9",
              "versionType": "git"
            },
            {
              "lessThan": "82f9e213b124a7d2bb5b16ea35d570260ef467e0",
              "status": "affected",
              "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9",
              "versionType": "git"
            },
            {
              "lessThan": "a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb",
              "status": "affected",
              "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9",
              "versionType": "git"
            },
            {
              "lessThan": "30d18df6567be09c1433e81993e35e3da573ac48",
              "status": "affected",
              "version": "d4dccf353db80e209f262e3973c834e6e48ba9a9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hv/channel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.91",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.31",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Don\u0027t free ring buffers that couldn\u0027t be re-encrypted\n\nIn CoCo VMs it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nThe VMBus ring buffer code could free decrypted/shared pages if\nset_memory_decrypted() fails. Check the decrypted field in the struct\nvmbus_gpadl for the ring buffers to decide whether to free the memory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker is the untrusted Hyper-V host/VMM of a confidential guest, reaching the vulnerable code through the paravirtual VMBus interface (GPADL creation status, channel rescind, and the host-visibility/page-state-change hypercalls backing set_memory_encrypted()), not through any network stack. This is a local, non-network attack channel against the guest kernel, consistent with the scoring of the sibling CoCo VMBus issues.\nAC:L - The host implements the page-conversion handler and can fail set_memory_encrypted()/set_memory_decrypted() on demand every time, while independently forcing the vmbus_open()/teardown error paths via GPADL creation status, OPENCHANNEL failure or channel rescind. No race, timing window, or memory layout outside the attacker\u0027s control is involved, and the sequence is repeatable to seed many shared pages.\nPR:N - Privileges are measured against the vulnerable component \u2014 the guest kernel \u2014 and in the SEV-SNP/TDX threat model the hypervisor holds no account, credential, or capability inside the guest and sits entirely outside its authentication domain. The affected paths run automatically from driver probe/remove and channel open/close, requiring nothing from the host but its normal VMBus role.\nUI:N - The vulnerable paths execute automatically when hv_vmbus devices are probed, opened, rescinded or removed, and the host initiates the failing conversion and the teardown itself. No guest user or administrator action is required.\nS:C - Returning still-decrypted pages to the buddy allocator voids the hardware-enforced SEV-SNP/TDX memory-confidentiality boundary \u2014 a protection managed by the CPU firmware/RMP, not by the guest kernel \u2014 for memory subsequently owned by every other authority in the guest (all processes, containers, and the guest TCB). This is directly analogous to an IOMMU/DMA boundary bypass, where impact extends well beyond the VMBus driver\u0027s own security scope.\nC:H - Megabytes of ring-buffer pages that remain mapped shared to the host are recycled by the page allocator for arbitrary kernel and user allocations \u2014 slab objects, page cache, anonymous user pages, page tables, cryptographic keys \u2014 giving the host a persistent, continuously refreshed plaintext read window into confidential guest memory. That is a total break of the confidential VM\u0027s core confidentiality guarantee.\nI:H - The same recycled pages remain host-writable, so the host obtains an arbitrary-write primitive into whatever live kernel object currently occupies them (credentials, page tables, structures holding function pointers or list heads), which is leverageable for full control-flow hijack and kernel compromise inside the guest.\nA:H - Host writes into live kernel data occupying the recycled pages, combined with the private/shared encryption-state mismatch left by the aborted conversion (#VE / EPT violations or ciphertext garbage on subsequent private accesses), reliably produces guest memory corruption and kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:56.472Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039"
        },
        {
          "url": "https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb"
        },
        {
          "url": "https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48"
        }
      ],
      "title": "Drivers: hv: vmbus: Don\u0027t free ring buffers that couldn\u0027t be re-encrypted",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36909",
    "datePublished": "2024-05-30T15:29:08.339Z",
    "dateReserved": "2024-05-30T15:25:07.067Z",
    "dateUpdated": "2026-08-05T11:31:56.472Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36909",
      "date": "2026-08-05",
      "epss": "0.00239",
      "percentile": "0.15006"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nDrivers: hv: vmbus: Don\u0027t free ring buffers that couldn\u0027t be re-encrypted\\n\\nIn CoCo VMs it is possible for the untrusted host to cause\\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\\nerror is returned and the resulting memory is shared. Callers need to\\ntake care to handle these errors to avoid returning decrypted (shared)\\nmemory to the page allocator, which could lead to functional or security\\nissues.\\n\\nThe VMBus ring buffer code could free decrypted/shared pages if\\nset_memory_decrypted() fails. Check the decrypted field in the struct\\nvmbus_gpadl for the ring buffers to decide whether to free the memory.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Controladores: hv: vmbus: no liberar b\\u00faferes de anillo que no se pudieron volver a cifrar. En las m\\u00e1quinas virtuales CoCo, es posible que el host que no es de confianza cause set_memory_encrypted() o set_memory_decrypted( ) falle de modo que se devuelva un error y se comparta la memoria resultante. Las personas que llaman deben tener cuidado al manejar estos errores para evitar devolver memoria descifrada (compartida) al asignador de p\\u00e1ginas, lo que podr\\u00eda provocar problemas funcionales o de seguridad. El c\\u00f3digo del buffer circular de VMBus podr\\u00eda liberar p\\u00e1ginas descifradas/compartidas si falla set_memory_decrypted(). Verifique el campo descifrado en la estructura vmbus_gpadl para ver los b\\u00faferes en anillo para decidir si liberar la memoria.\"}]",
      "id": "CVE-2024-36909",
      "lastModified": "2024-11-21T09:22:47.580",
      "published": "2024-05-30T16:15:14.380",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:15:25.000Z",
      "cve": "CVE-2024-36909",
      "id": "msrc_CVE-2024-36909",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Drivers: hv: vmbus: Don\u0027t free ring buffers that couldn\u0027t be re-encrypted",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-36909.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36909\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-30T16:15:14.380\",\"lastModified\":\"2026-08-04T11:18:29.040\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nDrivers: hv: vmbus: Don\u0027t free ring buffers that couldn\u0027t be re-encrypted\\n\\nIn CoCo VMs it is possible for the untrusted host to cause\\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\\nerror is returned and the resulting memory is shared. Callers need to\\ntake care to handle these errors to avoid returning decrypted (shared)\\nmemory to the page allocator, which could lead to functional or security\\nissues.\\n\\nThe VMBus ring buffer code could free decrypted/shared pages if\\nset_memory_decrypted() fails. Check the decrypted field in the struct\\nvmbus_gpadl for the ring buffers to decide whether to free the memory.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Controladores: hv: vmbus: no liberar b\u00faferes de anillo que no se pudieron volver a cifrar. En las m\u00e1quinas virtuales CoCo, es posible que el host que no es de confianza cause set_memory_encrypted() o set_memory_decrypted( ) falle de modo que se devuelva un error y se comparta la memoria resultante. Las personas que llaman deben tener cuidado al manejar estos errores para evitar devolver memoria descifrada (compartida) al asignador de p\u00e1ginas, lo que podr\u00eda provocar problemas funcionales o de seguridad. El c\u00f3digo del buffer circular de VMBus podr\u00eda liberar p\u00e1ginas descifradas/compartidas si falla set_memory_decrypted(). Verifique el campo descifrado en la estructura vmbus_gpadl para ver los b\u00faferes en anillo para decidir si liberar la memoria.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/hv/channel.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d4dccf353db80e209f262e3973c834e6e48ba9a9\",\"lessThan\":\"2f622008bf784a9f5dd17baa19223cc2ac30a039\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d4dccf353db80e209f262e3973c834e6e48ba9a9\",\"lessThan\":\"82f9e213b124a7d2bb5b16ea35d570260ef467e0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d4dccf353db80e209f262e3973c834e6e48ba9a9\",\"lessThan\":\"a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d4dccf353db80e209f262e3973c834e6e48ba9a9\",\"lessThan\":\"30d18df6567be09c1433e81993e35e3da573ac48\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/hv/channel.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.91\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.31\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.10\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-06T18:33:37.652556Z\",\"id\":\"CVE-2024-36909\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.1.91\",\"matchCriteriaId\":\"C7F044DD-06F0-44B2-8185-DCA23913A970\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.31\",\"matchCriteriaId\":\"CDDB1F69-36AC-41C1-9192-E7CCEF5FFC00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.10\",\"matchCriteriaId\":\"6A6B920C-8D8F-4130-86B4-AD334F4CF2E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:46:26+00:00",
      "cve": "CVE-2024-36909",
      "id": "CVE-2024-36909",
      "initial_release_date": "2024-05-30T00:00:00+00:00",
      "product_status:known_affected": "150",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Drivers: hv: vmbus: Don\u0026#39;t free ring buffers that couldn\u0026#39;t be re-encrypted",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36909.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-23T02:05:29Z",
      "cve": "CVE-2024-36909",
      "id": "CVE-2024-36909",
      "initial_release_date": "2024-06-01T02:23:24Z",
      "product_status:known_affected": "514",
      "product_status:known_not_affected": "58",
      "product_status:recommended": "658",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-36909",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-36909.json",
      "version": "83"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:43:50.141Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36909\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-06T18:33:37.652556Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-06T18:33:40.633Z\"}}], \"cna\": {\"title\": \"Drivers: hv: vmbus: Don\u0027t free ring buffers that couldn\u0027t be re-encrypted\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.3, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The attacker is the untrusted Hyper-V host/VMM of a confidential guest, reaching the vulnerable code through the paravirtual VMBus interface (GPADL creation status, channel rescind, and the host-visibility/page-state-change hypercalls backing set_memory_encrypted()), not through any network stack. This is a local, non-network attack channel against the guest kernel, consistent with the scoring of the sibling CoCo VMBus issues.\\nAC:L - The host implements the page-conversion handler and can fail set_memory_encrypted()/set_memory_decrypted() on demand every time, while independently forcing the vmbus_open()/teardown error paths via GPADL creation status, OPENCHANNEL failure or channel rescind. No race, timing window, or memory layout outside the attacker\u0027s control is involved, and the sequence is repeatable to seed many shared pages.\\nPR:N - Privileges are measured against the vulnerable component \\u2014 the guest kernel \\u2014 and in the SEV-SNP/TDX threat model the hypervisor holds no account, credential, or capability inside the guest and sits entirely outside its authentication domain. The affected paths run automatically from driver probe/remove and channel open/close, requiring nothing from the host but its normal VMBus role.\\nUI:N - The vulnerable paths execute automatically when hv_vmbus devices are probed, opened, rescinded or removed, and the host initiates the failing conversion and the teardown itself. No guest user or administrator action is required.\\nS:C - Returning still-decrypted pages to the buddy allocator voids the hardware-enforced SEV-SNP/TDX memory-confidentiality boundary \\u2014 a protection managed by the CPU firmware/RMP, not by the guest kernel \\u2014 for memory subsequently owned by every other authority in the guest (all processes, containers, and the guest TCB). This is directly analogous to an IOMMU/DMA boundary bypass, where impact extends well beyond the VMBus driver\u0027s own security scope.\\nC:H - Megabytes of ring-buffer pages that remain mapped shared to the host are recycled by the page allocator for arbitrary kernel and user allocations \\u2014 slab objects, page cache, anonymous user pages, page tables, cryptographic keys \\u2014 giving the host a persistent, continuously refreshed plaintext read window into confidential guest memory. That is a total break of the confidential VM\u0027s core confidentiality guarantee.\\nI:H - The same recycled pages remain host-writable, so the host obtains an arbitrary-write primitive into whatever live kernel object currently occupies them (credentials, page tables, structures holding function pointers or list heads), which is leverageable for full control-flow hijack and kernel compromise inside the guest.\\nA:H - Host writes into live kernel data occupying the recycled pages, combined with the private/shared encryption-state mismatch left by the aborted conversion (#VE / EPT violations or ciphertext garbage on subsequent private accesses), reliably produces guest memory corruption and kernel panic.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d4dccf353db80e209f262e3973c834e6e48ba9a9\", \"lessThan\": \"2f622008bf784a9f5dd17baa19223cc2ac30a039\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d4dccf353db80e209f262e3973c834e6e48ba9a9\", \"lessThan\": \"82f9e213b124a7d2bb5b16ea35d570260ef467e0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d4dccf353db80e209f262e3973c834e6e48ba9a9\", \"lessThan\": \"a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d4dccf353db80e209f262e3973c834e6e48ba9a9\", \"lessThan\": \"30d18df6567be09c1433e81993e35e3da573ac48\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/hv/channel.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.91\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.31\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/hv/channel.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039\"}, {\"url\": \"https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0\"}, {\"url\": \"https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb\"}, {\"url\": \"https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nDrivers: hv: vmbus: Don\u0027t free ring buffers that couldn\u0027t be re-encrypted\\n\\nIn CoCo VMs it is possible for the untrusted host to cause\\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\\nerror is returned and the resulting memory is shared. Callers need to\\ntake care to handle these errors to avoid returning decrypted (shared)\\nmemory to the page allocator, which could lead to functional or security\\nissues.\\n\\nThe VMBus ring buffer code could free decrypted/shared pages if\\nset_memory_decrypted() fails. Check the decrypted field in the struct\\nvmbus_gpadl for the ring buffers to decide whether to free the memory.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.91\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.31\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.10\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"5.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:56.472Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36909\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:56.472Z\", \"dateReserved\": \"2024-05-30T15:25:07.067Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-30T15:29:08.339Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.