PT-2024-27201 · Linux+6 · Linux Kernel+6

Rick Edgecombe · Published 2024-03-11 · Updated 2026-05-26 · CVE-2024-36910

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In CoCo VMs, an untrusted host can cause set memory encrypted() or set memory decrypted() to fail, resulting in shared memory. Callers must handle these errors to avoid returning decrypted memory to the page allocator, which could lead to functional or security issues. The VMBus device UIO driver could free decrypted/shared pages if set memory decrypted() fails. Checking the decrypted field in the gpadl can help decide whether to free the memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Information Disclosure

Weakness Enumeration

CWE-402

CWE-200

Related Identifiers

AZL-43248

AZL-43285

BDU:2025-04529

CVE-2024-36910

MGASA-2024-0263

MGASA-2024-0266

OESA-2024-2296

OPENSUSE-SU-2024_2947-1

SUSE-SU-2024:2802-1

SUSE-SU-2024:2894-1

SUSE-SU-2024:2896-1

SUSE-SU-2024:2939-1

SUSE-SU-2024:2947-1

SUSE-SU-2024:2973-1

SUSE-SU-2024:3194-1

SUSE-SU-2024:3383-1

SUSE-SU-2025:20008-1

SUSE-SU-2025:20028-1

USN-6949-1

USN-6949-2

USN-6952-1

USN-6952-2

USN-6955-1

Affected Products

Astra Linux

Debian

Linuxmint

Linux Kernel

Red Os

Suse

Ubuntu

References · 3616

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36910.json · Exploit
• https://ubuntu.com/security/CVE-2024-36003 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36962 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-36910 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38590 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36892 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42104 · Security Note
• https://osv.dev/vulnerability/USN-6949-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36904 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43285 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2939-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38599 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2296 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36918 · Security Note
• https://ubuntu.com/security/CVE-2024-38583 · Vendor Advisory