CVE-2024-36910: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability (CVE-2024-36910) was discovered in the uio_hv_generic driver. The issue was disclosed on May 30, 2024, and affects the VMBus device UIO driver's handling of decrypted memory in Confidential Computing (CoCo) VMs (NVD).

The vulnerability occurs when an untrusted host can cause set_memory_encrypted() or set_memory_decrypted() to fail, resulting in an error being returned while the memory remains shared. The VMBus device UIO driver could incorrectly free decrypted/shared pages if set_memory_decrypted() fails, potentially leading to security issues. The CVSS v3.1 base score is 6.2 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

This vulnerability could lead to functional or security issues when decrypted (shared) memory is incorrectly returned to the page allocator. The impact primarily affects the confidentiality of memory in CoCo VMs, potentially exposing sensitive information to unauthorized actors (NVD).

The vulnerability requires local access and can be exploited by an untrusted host to manipulate memory encryption operations in CoCo VMs. The attack complexity is considered low, requiring no privileges or user interaction (NVD).

The issue has been patched by modifying the uio_hv_generic driver to check the decrypted field in the gpadl before freeing memory. The fix ensures proper handling of decrypted memory by only freeing it when appropriate (Kernel Commit).