CVE-2024-36913

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37

Description The issue arises in CoCo VMs where an untrusted host can cause set memory encrypted() or set memory decrypted() to fail, leading to shared memory. Callers must handle these errors to prevent returning decrypted memory to the page allocator, which could result in functional or security issues. The VMBus code may free decrypted pages if set memory encrypted() or set memory decrypted() fails, potentially leaking pages.

Recommendations Update to Linux kernel version 6.6.37 or later to resolve the issue. As a temporary workaround, consider implementing error handling for set memory encrypted() and set memory decrypted() failures to prevent decrypted memory from being returned to the page allocator. Restrict access to the VMBus code to minimize the risk of exploitation until a patch is applied.