CVE-2024-36909

What it actually does

The VMBus ring buffer handling in the Linux kernel fails to check the decrypted field of struct vmbus_gpadl after set_memory_decrypted() returns an error in CoCo VMs, allowing decrypted/shared pages to be freed back to the page allocator.

Why it matters to the business

Organizations running Linux kernels on confidential compute VMs face elevated risk of memory corruption that can cause system instability, crashes, or exposure of sensitive data to the hypervisor; the low EPSS and absence from KEV indicate limited in-the-wild exploitation so far, but the fix has been available since May 2024.

How an attack unfolds

An attacker controlling the host in a CoCo VM environment triggers failure of set_memory_decrypted() during VMBus ring buffer setup; the kernel then frees the still-shared pages, allowing the attacker to reclaim and manipulate that memory for corruption or information disclosure.

How to fix it

Upgrade the Linux kernel to the commit 2f622008bf784a9f5dd17baa19223cc2ac30a039 or later stable releases that contain the fix; apply the patch that adds the decrypted-field check before freeing ring-buffer memory.

How to confirm the fix worked

Verify the running kernel contains commit 2f622008bf784a9f5dd17baa19223cc2ac30a039; confirm the vmbus_gpadl decrypted field is now checked before any ring-buffer free operation.

Typical attack path

1. Compromise or control the hypervisor/host in a CoCo VM deployment
2. Force set_memory_decrypted() to fail for a VMBus ring buffer allocation
3. Trigger VMBus ring buffer teardown that frees the still-shared pages
4. Reclaim the freed shared memory to corrupt kernel structures or leak data

How to detect it

Review kernel logs for set_memory_decrypted failures followed by VMBus ring-buffer teardown; look for page allocator warnings or memory corruption symptoms on CoCo VMs after VMBus operations.

What your security team should do

• Prioritize kernel updates on all CoCo VM hosts within the next maintenance window
• Audit VMBus-dependent workloads for any custom ring-buffer handling that may require similar hardening
• Monitor vendor advisories for backported fixes in distribution kernels