CVE-2024-36911

What it actually does

hv_netvsc driver may return decrypted/shared memory pages to the allocator when set_memory_decrypted() fails in CoCo VMs, allowing the untrusted host to cause shared memory to be reused.

Why it matters to the business

Confidential computing workloads on Linux may experience data exposure or instability when running on untrusted hypervisors, increasing risk for cloud and virtualized deployments.

How an attack unfolds

An attacker controlling the host in a CoCo VM environment forces set_memory_decrypted() to fail for the netvsc driver; the driver then frees the resulting shared pages without checking the decrypted flag, enabling the host to observe or corrupt memory contents.

How to fix it

Update the Linux kernel to include commit a56fe611326332bf6b7126e5559590c57dcebad4 which adds the decrypted field check before freeing gpadl memory.

How to confirm the fix worked

Confirm the fix commit is present in the kernel tree or verify the hv_netvsc code checks the decrypted flag on gpadl before calling free.

Typical attack path

1. Gain control of the hypervisor or host in a confidential VM setup
2. Trigger failure of set_memory_decrypted() during netvsc gpadl handling
3. Cause the driver to free shared memory pages to the allocator
4. Reuse or inspect the freed pages to read sensitive guest data

How to detect it

Inspect kernel logs for set_memory_decrypted failures combined with netvsc gpadl operations; monitor for unexpected page sharing events in CoCo environments.

What your security team should do

• Apply the referenced kernel commit or later stable release containing the fix
• Prioritize patching confidential computing (CoCo) VM fleets
• Review hypervisor trust assumptions for affected Linux guests