CVE-2024-36910: linux-libc-dev - uio_hv_generic: Don't free decrypted memory
Summary
CVE-2024-36910: In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted()... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling programs that use the Linux kernel's C library interface. It is an essential component for building and running applications on Linux systems. The vulnerability affects version 6.1.90-1 of the linux-libc-dev package.
Vulnerability Detail
The vulnerability (CVE-2024-36910) in the linux-libc-dev package is related to the uio_hv_generic driver in the Linux kernel. It allows an untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail, resulting in decrypted (shared) memory being returned to the page allocator. This can lead to functional or security issues. Specifically, the VMBus device UIO driver could free decrypted/shared pages if set_memory_decrypted() fails. It is important for callers to handle these errors properly to avoid returning decrypted memory to the page allocator.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The linux-libc-dev package, specifically the uio_hv_generic driver in the Linux kernel, is vulnerable to a memory decryption issue. This vulnerability can potentially lead to functional or security issues if decrypted memory is returned to the page allocator. It is recommended to update the linux-libc-dev package to a patched version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package provides the necessary header files and libraries for compiling programs that use the Linux kernel's C library interface. It is an essential component for building and running applications on Linux systems.
The vulnerability can lead to functional or security issues if decrypted (shared) memory is returned to the page allocator. This could potentially be exploited by an attacker to gain unauthorized access or cause system instability.
To fix this vulnerability, it is recommended to update the linux-libc-dev package to a version that includes the patch for this issue. Users should check for updates from their Linux distribution or package repository and apply the latest available version of the linux-libc-dev package.
No specific workaround has been mentioned for this vulnerability.
More information about this vulnerability can be found in the references provided, including the CVE entry and the Debian Security Tracker.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
