Bug 1225752 (CVE-2024-36912)

Summary: VUL-0: CVE-2024-36912: kernel: Drivers: hv: vmbus: track decrypted status in vmbus_gpadl
Product: [Novell Products] SUSE Security Incidents Reporter: SMASH SMASH <smash_bz>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: REOPENED --- QA Contact: Security Team bot <security-team>
Severity: Major    
Priority: P3 - Medium CC: camila.matos, vasant.karasulli
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/408209/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-36912:5.5:(AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description SMASH SMASH 2024-05-31 13:37:01 UTC 
In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl

In CoCo VMs it is possible for the untrusted host to cause
set_memory_encrypted() or set_memory_decrypted() to fail such that an
error is returned and the resulting memory is shared. Callers need to
take care to handle these errors to avoid returning decrypted (shared)
memory to the page allocator, which could lead to functional or security
issues.

In order to make sure callers of vmbus_establish_gpadl() and
vmbus_teardown_gpadl() don't return decrypted/shared pages to
allocators, add a field in struct vmbus_gpadl to keep track of the
decryption status of the buffers. This will allow the callers to
know if they should free or leak the pages.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-36912
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-36912.mbox
https://git.kernel.org/stable/c/1999644d95194d4a58d3e80ad04ce19220a01a81
https://git.kernel.org/stable/c/8e62341f5c45b27519b7d193bcc32ada416ad9d8
https://git.kernel.org/stable/c/bfae56be077ba14311509e70706a13458f87ea99
https://git.kernel.org/stable/c/211f514ebf1ef5de37b1cf6df9d28a56cfd242ca
https://www.cve.org/CVERecord?id=CVE-2024-36912
Comment 3 Olaf Hering 2024-07-10 16:34:32 UTC 
fixes submitted to for-next.
Comment 4 Olaf Hering 2024-07-10 19:59:14 UTC 
security-team@suse.de