Security readout for executives and security teams
Plain-English summary
A malicious or compromised host may cause a Linux confidential-computing guest to return shared, decrypted VMBus ring-buffer pages to its normal memory pool. Reuse of those pages could expose or corrupt sensitive guest data and disrupt workloads. The supplied record rates this critical, but does not show that ordinary non-confidential Linux systems are affected.
Executive priority
Treat remediation as urgent for confidential workloads whose virtualization host is outside the guest's trust boundary, especially multi-tenant or high-value environments. Other Linux estates should first validate whether CoCo and Hyper-V VMBus conditions exist before assigning emergency priority.
Technical view
In CoCo virtual machines, an untrusted host can make memory encryption-state transitions fail while leaving pages shared. The VMBus ring-buffer cleanup path could then free those pages to the allocator. The kernel fix checks the vmbus_gpadl decrypted state and avoids freeing ring buffers that could not be safely re-encrypted.
Likely exposure
Exposure is most plausible for Linux confidential-computing guests using Hyper-V VMBus where the host is untrusted or compromised. The supplied affected data names 5.16, 6.1.91, 6.6.31, 6.8.10, and 6.9, but does not clearly define version ranges or distribution backports.
Exploitation context
The CVSS vector describes local attack proximity, no privileges, no user interaction, changed scope, and high confidentiality, integrity, and availability impact. The bundle marks the CVE as absent from KEV and provides no evidence of active exploitation or a public exploit.
Researcher notes
The vulnerability concerns unsafe allocator return after a failed encryption-state transition, not merely a crash. The supplied record provides four stable-kernel commits but no explicit mapping between each commit and affected branches. It also supplies no CWE, exploitation telemetry, proof of concept, or distribution-specific advisory.
Mitigation direction
- Identify confidential-computing Linux guests using Hyper-V VMBus.
- Obtain a distribution kernel containing the applicable upstream stable fix.
- Prioritize guests running an affected or ambiguously mapped kernel version.
- Follow vendor guidance where distribution backports obscure upstream version mapping.
- Restrict and monitor administrative access to virtualization hosts.
Validation and detection
- Record each guest's kernel and distribution package versions.
- Confirm the vendor package includes the applicable cited stable commit.
- Verify whether each workload is a confidential-computing virtual machine.
- Confirm Hyper-V VMBus ring-buffer functionality is present and used.
- Reassess exposure after kernel updates and guest restarts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-36909 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H2.56LinuxVulnerability scoring details
Base CVSS 3.1 score
9.3CriticalVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039CVE reference, Linux
- https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0CVE reference, Linux
- https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abbCVE reference, Linux
- https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.