CVE-2024-36910

What it actually does

In CoCo VMs the uio_hv_generic driver can return decrypted/shared pages to the page allocator when set_memory_decrypted() fails because it does not check the decrypted field in the gpadl before freeing memory.

Why it matters to the business

Linux systems running confidential VMs may experience memory corruption leading to crashes, data leaks, or privilege escalation with no public exploitation observed to date.

How an attack unfolds

An untrusted host forces set_memory_decrypted() to fail so the resulting shared pages are freed by the VMBus UIO driver; an attacker then reclaims or manipulates those pages to corrupt kernel memory or leak secrets.

How to fix it

Update the Linux kernel to the commit dabf12bf994318d939f70d47cfda30e47abb2c54 or later stable releases that contain the fix; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the presence of commit dabf12bf994318d939f70d47cfda30e47abb2c54 in the running kernel source; verify that the gpadl decrypted field is checked before any free operation in uio_hv_generic.c.

Typical attack path

1. Untrusted host induces failure of set_memory_decrypted() on a CoCo VM
2. uio_hv_generic driver frees the still-decrypted gpadl pages to the allocator
3. Attacker reclaims or re-maps the freed shared pages to corrupt kernel structures

How to detect it

Review kernel logs for set_memory_decrypted failures followed by page-free operations in uio_hv_generic; inspect dmesg and audit logs for unexpected shared-page allocations or page-allocator warnings on CoCo VMs.

What your security team should do

• Apply the kernel update containing commit dabf12bf994318d939f70d47cfda30e47abb2c54 as soon as possible on CoCo VM hosts
• Prioritize patching systems that expose VMBus UIO devices
• Monitor vendor kernel advisories for backported fixes in distribution packages