CVE-2024-36913

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36913

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. VMBus code could free decrypted pages if set_memory_encrypted()/decrypted() fails. Leak the pages if this happens.

References
Link Resource
https://git.kernel.org/stable/c/03f5a999adba062456c8c818a683beb1b498983a Patch
https://git.kernel.org/stable/c/6123a4e8e25bd40cf44db14694abac00e6b664e6 Patch
https://git.kernel.org/stable/c/7f2afcbfe4f6b6047b5f68db5067b7321e5be125 Patch
https://git.kernel.org/stable/c/e813a0fc2e597146e9cebea61ced9c796d4e308f Patch
https://git.kernel.org/stable/c/03f5a999adba062456c8c818a683beb1b498983a Patch
https://git.kernel.org/stable/c/6123a4e8e25bd40cf44db14694abac00e6b664e6 Patch
https://git.kernel.org/stable/c/e813a0fc2e597146e9cebea61ced9c796d4e308f Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
History

14 Nov 2025, 17:15

Type Values Removed Values Added
CPE cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/7f2afcbfe4f6b6047b5f68db5067b7321e5be125 - () https://git.kernel.org/stable/c/7f2afcbfe4f6b6047b5f68db5067b7321e5be125 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Mailing List, Third Party Advisory
First Time Debian
Debian debian Linux

03 Nov 2025, 18:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

06 Jul 2025, 10:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/7f2afcbfe4f6b6047b5f68db5067b7321e5be125 -

01 Apr 2025, 18:35

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/03f5a999adba062456c8c818a683beb1b498983a - () https://git.kernel.org/stable/c/03f5a999adba062456c8c818a683beb1b498983a - Patch
References () https://git.kernel.org/stable/c/6123a4e8e25bd40cf44db14694abac00e6b664e6 - () https://git.kernel.org/stable/c/6123a4e8e25bd40cf44db14694abac00e6b664e6 - Patch
References () https://git.kernel.org/stable/c/e813a0fc2e597146e9cebea61ced9c796d4e308f - () https://git.kernel.org/stable/c/e813a0fc2e597146e9cebea61ced9c796d4e308f - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux

21 Nov 2024, 09:22

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/03f5a999adba062456c8c818a683beb1b498983a - () https://git.kernel.org/stable/c/03f5a999adba062456c8c818a683beb1b498983a -
References () https://git.kernel.org/stable/c/6123a4e8e25bd40cf44db14694abac00e6b664e6 - () https://git.kernel.org/stable/c/6123a4e8e25bd40cf44db14694abac00e6b664e6 -
References () https://git.kernel.org/stable/c/e813a0fc2e597146e9cebea61ced9c796d4e308f - () https://git.kernel.org/stable/c/e813a0fc2e597146e9cebea61ced9c796d4e308f -

03 Jul 2024, 02:03

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.1
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Controladores: hv: vmbus: páginas de fuga si falla set_memory_encrypted() En máquinas virtuales CoCo, es posible que el host que no es de confianza provoque que set_memory_encrypted() o set_memory_decrypted() falle de manera que se produzca un error se devuelve y la memoria resultante se comparte. Las personas que llaman deben tener cuidado al manejar estos errores para evitar devolver memoria descifrada (compartida) al asignador de páginas, lo que podría provocar problemas funcionales o de seguridad. El código VMBus podría liberar páginas descifradas si falla set_memory_encrypted()/decrypted(). Filtre las páginas si esto sucede.
CWE CWE-1258

30 May 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-30 16:15

Updated : 2025-11-14 17:15

NVD link : CVE-2024-36913

Mitre link : CVE-2024-36913

CVE.ORG link : CVE-2024-36913

JSON object : View

Products Affected

linux

debian

CWE
CWE-1258

Exposure of Sensitive System Information Due to Uncleared Debug Information