CVE-2024-36912: Linux Kernel Privilege Escalation Flaw

CVE-2024-36912 Overview

CVE-2024-36912 is a Linux kernel vulnerability in the Hyper-V VMBus driver (drivers/hv/vmbus) affecting Confidential Computing (CoCo) virtual machines. The flaw resides in the Guest Physical Address Descriptor List (GPADL) handling, where callers of vmbus_establish_gpadl() and vmbus_teardown_gpadl() did not track the decryption status of buffers. An untrusted host can force set_memory_encrypted() or set_memory_decrypted() to fail, leaving memory in a shared state. Without tracking, the kernel may return decrypted (shared) pages to the page allocator, breaking the isolation guarantees of confidential VMs.

Critical Impact
An untrusted hypervisor can manipulate memory encryption state transitions to leak sensitive guest data from CoCo VMs, undermining the confidentiality model that protects tenant workloads from a malicious host.

Affected Products

Linux Kernel versions prior to the fix in stable branches
Linux Kernel 6.9-rc1, 6.9-rc2, 6.9-rc3 release candidates
Hyper-V guests running as Confidential Computing VMs (AMD SEV-SNP, Intel TDX)

Discovery Timeline

2024-05-30 - CVE-2024-36912 published to NVD
2025-11-18 - Last updated in NVD database

Technical Details for CVE-2024-36912

Vulnerability Analysis

The vulnerability is classified under [CWE-1258] (Exposure of Sensitive System Information Due to Uncleared Debug Information). It affects the VMBus communication channel between Hyper-V guests and the host. VMBus uses GPADL structures to share ring buffers between the guest and the hypervisor. In CoCo VMs, these buffers must transition between encrypted (private) and decrypted (shared) states using set_memory_encrypted() and set_memory_decrypted() helpers.

When the untrusted host triggers a failure in these state transitions, the memory may remain shared even though the caller assumed the operation succeeded or was reversed. The original code did not record per-buffer decryption status in struct vmbus_gpadl. Callers releasing the GPADL had no way to determine whether pages were safe to free back to the page allocator or whether they remained shared with the host.

Root Cause

The root cause is missing state tracking in the vmbus_gpadl structure. The kernel optimistically assumed memory encryption transitions were atomic and always successful. A malicious or compromised hypervisor can return errors from these operations, creating a window where the guest believes pages are private when they are still mapped as shared with the host.

Attack Vector

Exploitation requires control of the hypervisor or host hosting the CoCo guest. The attacker induces failure in memory encryption hypercalls during VMBus channel establishment or teardown. If the guest subsequently writes sensitive data to a returned page, the host retains read access. The patch adds a decrypted field to struct vmbus_gpadl, allowing callers to detect this condition and leak the pages rather than return them to the allocator.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-36912

Indicators of Compromise

Kernel log entries showing failures from set_memory_encrypted() or set_memory_decrypted() calls originating in drivers/hv/
Unexpected VMBus channel teardown errors in dmesg on CoCo guests
Anomalous memory page state transitions during Hyper-V guest boot or device hot-add events

Detection Strategies

Monitor kernel versions across Hyper-V CoCo guests and compare against the patched stable branches referenced in the kernel.org commits
Audit guest kernel boot parameters and confirm CoCo isolation features (SEV-SNP, TDX) are reporting healthy attestation
Correlate hypervisor-side telemetry with guest kernel logs to identify host-induced encryption hypercall failures

Monitoring Recommendations

Ingest syslog and kernel ring buffer data from Linux CoCo guests into a centralized logging platform for anomaly detection
Track package and kernel inventory across Hyper-V guest fleets to identify hosts still running vulnerable kernels
Alert on repeated VMBus GPADL establishment or teardown failures, which may indicate malicious hypervisor interaction

How to Mitigate CVE-2024-36912

Immediate Actions Required

Update affected Linux kernels to a version containing the upstream fix on stable branches
Prioritize patching CoCo guests running on Hyper-V (AMD SEV-SNP or Intel TDX configurations) where the trust boundary with the host is most relevant
Validate attestation reports after patching to confirm guest isolation remains intact

Patch Information

The fix adds a decrypted field to struct vmbus_gpadl and updates callers in the Hyper-V VMBus driver to honor it. Patches are available in the upstream stable trees via the following commits: 1999644d9519, 211f514ebf1e, 8e62341f5c45, and bfae56be077b. Distribution vendors have backported the change to supported kernel branches.

Workarounds

No effective in-guest workaround exists because the trust model assumes a potentially malicious host; patching the kernel is required
Where patching is delayed, operate sensitive workloads only on trusted Hyper-V hosts and limit attack surface by disabling non-essential VMBus devices
Monitor for kernel warnings related to memory encryption state transitions and investigate any failures promptly

bash

# Verify kernel version on affected Hyper-V CoCo guests
uname -r

# Example: apply distribution kernel updates
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-generic
sudo dnf update kernel

# Reboot to activate the patched kernel
sudo systemctl reboot