CVE-2024-36911: hv_netvsc: Don't free decrypted memory
hvnetvsc: Don't free decrypted memory
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.25-1Fixed in 6.12.27-1 - Configuration
Update hv_netvsc/netvsc to handle failures from set_memory_encrypted() or set_memory_decrypted(): if either call fails and returns an error such that the resulting memory is shared, check the decrypted field in the gpadl and free the memory only when decrypted indicates it is safe (i.e., avoid returning decrypted (shared) memory to the page allocator).
hv_netvsc (Linux kernel netvsc driver) memory free behavior on set_memory_encrypted()/set_memory_decrypted() failure = Do not free decrypted/shared memory when set_memory_encrypted() or set_memory_decrypted() fails
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36911?
CVE-2024-36911 has a high severity due to its potential impact on the security of CoCo VMs in the Linux kernel.
How do I fix CVE-2024-36911?
To fix CVE-2024-36911, update your Linux kernel to version 6.12.12-1 or 6.12.16-1 or apply the relevant security patches.
Which versions of Linux are affected by CVE-2024-36911?
CVE-2024-36911 affects Linux kernel versions up to and including 5.10.234-1 and 6.1.128-1.
What types of systems are vulnerable to CVE-2024-36911?
CVE-2024-36911 primarily affects CoCo VMs running on the Linux kernel.
Is CVE-2024-36911 related to memory management?
Yes, CVE-2024-36911 involves issues with memory decryption handling in the Linux kernel.