CVE-2024-36913

Name	CVE-2024-36913
Description	In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. VMBus code could free decrypted pages if set_memory_encrypted()/decrypted() fails. Leak the pages if this happens.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
linux (PTS)	jessie, jessie (lts)	3.16.84-1	vulnerable
	stretch (security)	4.9.320-2	vulnerable
	stretch (lts), stretch	4.9.320-3	vulnerable
	buster (security), buster, buster (lts)	4.19.316-1	vulnerable
	bullseye	5.10.223-1	vulnerable
	bullseye (security)	5.10.226-1	vulnerable
	bookworm	6.1.106-3	vulnerable
	bookworm (security)	6.1.112-1	vulnerable
	sid, trixie	6.11.5-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency
linux	source	jessie	(unfixed)	end-of-life
linux	source	stretch	(unfixed)	end-of-life
linux	source	buster	(unfixed)	end-of-life
linux	source	(unstable)	6.8.11-1

https://git.kernel.org/linus/03f5a999adba062456c8c818a683beb1b498983a (6.9-rc4)