CVE-2024-36913

What it actually does

Failure to handle errors from set_memory_encrypted() in VMBus allows decrypted (shared) pages to be returned to the page allocator in CoCo VMs, enabling memory corruption or unintended sharing of sensitive kernel memory with an untrusted host.

Why it matters to the business

Organizations running Linux-based confidential computing workloads face elevated risk of data exposure or system instability when virtual machines are hosted on potentially compromised hypervisors, increasing operational and compliance costs until kernels are updated.

How an attack unfolds

An attacker with control over the host hypervisor induces set_memory_encrypted() or set_memory_decrypted() failures during VMBus page handling; the kernel then frees or reuses the resulting shared pages, allowing the host to read or corrupt guest memory contents.

How to fix it

Upgrade the Linux kernel to a version containing commit 7f2afcbfe4f6b6047b5f68db5067b7321e5be125 or later; apply the same fix across all stable branches used in production CoCo environments and verify the change is present before rebooting affected VMs.

How to confirm the fix worked

Confirm the patched commit is included in the running kernel source tree or binary; test by simulating encryption call failures in a controlled CoCo VM and verify that pages are leaked rather than freed.

Typical attack path

1. Gain control of the hypervisor hosting a CoCo VM
2. Trigger VMBus operations that invoke set_memory_encrypted()
3. Force the encryption call to fail and return shared memory
4. Observe or manipulate the decrypted pages returned to the allocator

How to detect it

Review kernel logs for VMBus messages indicating set_memory_encrypted or set_memory_decrypted failures; correlate with unusual page allocator activity or shared-memory warnings in CoCo VM boot or runtime traces.

What your security team should do

• Prioritize kernel updates on all confidential computing VMs within the next maintenance window
• Audit hypervisor trust boundaries and limit host privileges where possible
• Enable kernel logging for VMBus and memory encryption errors to detect anomalies
• Monitor upstream stable kernel releases for additional related fixes