CVE-2024-57793

What it actually does

In confidential compute VMs, failure of set_memory_decrypted() returns shared memory to the page allocator instead of handling the error, risking functional or security problems from decrypted memory exposure.

Why it matters to the business

May enable unauthorized access to sensitive VM data or cause instability in secure virtualized environments; low EPSS indicates limited active exploitation risk despite mentions in broader Linux kernel campaigns by espionage and financially motivated actors.

How an attack unfolds

An untrusted host forces set_memory_decrypted() to fail, causing the resulting shared memory to be returned to the allocator where it can be reused and accessed by other contexts, potentially leading to information disclosure; referenced in 2024 zero-day campaigns and Linux kernel out-of-bounds access activity by espionage actors.

How to fix it

Apply kernel updates that leak decrypted memory on unrecoverable set_memory_decrypted errors; for listed chromium-browser packages on Ubuntu 14.04 LTS upgrade to 58.0.3029.81-0ubuntu0.14.04.1172 or later.

How to confirm the fix worked

Verify presence of the leak-on-error change in virt/tdx-guest.c and confirm absence of shared memory return paths on failure; test CoCo VM error injection scenarios.

Typical attack path

1. Position as untrusted host to induce set_memory_decrypted failure
2. Allow erroneous shared memory return to page allocator
3. Reuse or access the leaked decrypted memory in another context
4. Extract sensitive information or trigger functional issues

How to detect it

Search kernel logs for WARN_ONCE messages from set_memory_decrypted, audit VM memory allocation events for unexpected sharing, and review traces from 2024 Linux kernel exploitation campaigns by listed threat actors.

What your security team should do

• Prioritize kernel patching in TDX-enabled environments due to potential espionage actor interest
• Review CoCo VM memory handling code for similar error paths
• Monitor kernel logs for set_memory_decrypted WARN_ONCE occurrences