CVE-2024-57793: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-57793 is a vulnerability in the Linux kernel's TDX (Trust Domain Extensions) guest component, specifically affecting CoCo (Confidential Computing) Virtual Machines. The vulnerability was discovered and disclosed on January 11, 2025. The issue involves the handling of decrypted memory in cases where the set_memory_decrypted() function fails (NVD).

The vulnerability occurs in the TDX guest component where an untrusted host can cause set_memory_decrypted() to fail, resulting in memory being shared when it shouldn't be. The technical issue specifically relates to error handling in the alloc_quote_buf() function within the tdx-guest.c file. When set_memory_decrypted() fails, the original implementation would return decrypted (shared) memory to the page allocator, potentially leading to security issues (Kernel Git).

The vulnerability could lead to functional and security issues in CoCo VMs, particularly when decrypted memory is inappropriately shared with the page allocator. This could potentially compromise the confidentiality of sensitive data in affected virtual machines (Kernel Git).

The vulnerability can be triggered by an untrusted host causing set_memory_decrypted() to fail, which results in memory being inappropriately shared. This affects systems running CoCo VMs with TDX guest implementation (NVD).

The issue has been resolved by modifying the error handling behavior to leak the decrypted memory when set_memory_decrypted() fails, rather than returning it to the page allocator. The fix includes removing the free_pages_exact() call and simply returning NULL on failure (Kernel Git).