---
cve: "CVE-2024-36913"
severity: "CRITICAL"
cvss: 9.3
epss: "0.7%"
vendor: "Linux"
kev: false
exploited: false
published: "2024-05-30 16:15:14"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-10-22T01:52:24+02:00"
---

# CVE-2024-36913

> 9.3 CRITICAL

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails

In CoCo VMs it is possible for the untrusted host to cause
set_memory_encrypted() or set_memory_decrypted() to fail such that an
error is returned and the resulting memory is shared. Callers need to
take care to handle these errors to avoid returning decrypted (shared)
memory to the page allocator, which could lead to functional or security
issues.

VMBus code could free decrypted pages if set_memory_encrypted()/decrypted()
fails. Leak the pages if this happens.

## CNA-Record (Kanon, cvelistV5)

- CNA: **Linux**
- State: PUBLISHED
- Stand: 2026-08-05 11:32:00
- CNA-CVSS: **9.3** (`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-1258** — Exposure of Sensitive System Information Due to Uncleared Debug Information
  The hardware does not fully clear security-sensitive values, such as keys and intermediate values in cryptographic operations, when debug mode is entered.

## Angriffsmuster (CAPEC)

- [CAPEC-37 — Retrieve Embedded Sensitive Data](https://capec.mitre.org/data/definitions/37.html) _(Severity: Very High)_
- [CAPEC-150 — Collect Data from Common Resource Locations](https://capec.mitre.org/data/definitions/150.html) _(Severity: Medium)_
- [CAPEC-204 — Lifting Sensitive Data Embedded in Cache](https://capec.mitre.org/data/definitions/204.html) _(Severity: Medium)_
- [CAPEC-545 — Pull Data from System Resources](https://capec.mitre.org/data/definitions/545.html)

## ATT&CK-Techniken

- [T1005 — Data from Local System](https://attack.mitre.org/techniques/T1005/)
- [T1552.004 — Unsecured Credentials: Private Keys](https://attack.mitre.org/techniques/T1552/004/)
- [T1003 — OS Credential Dumping](https://attack.mitre.org/techniques/T1003/)
- [T1119 — Automated Collection](https://attack.mitre.org/techniques/T1119/)
- [T1213 — Data from Information Repositories](https://attack.mitre.org/techniques/T1213/)
- [T1530 — Data from Cloud Storage Object](https://attack.mitre.org/techniques/T1530/)
- [T1555.001 — Credentials from Password Stores:Keychain](https://attack.mitre.org/techniques/T1555/001/)

## Patch verfügbar (OSV)

- Kernel ≥ 6.1.143
- Kernel ≥ 6.6.31
- Kernel ≥ 6.8.10

## BSI-Hinweise (deutsch)

- [Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service und unspezifischen Angriff](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2024-1259) — _BSI-Einstufung: mittel_
  Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuführen.

## Referenzen

- <https://git.kernel.org/stable/c/7f2afcbfe4f6b6047b5f68db5067b7321e5be125>
- <https://git.kernel.org/stable/c/6123a4e8e25bd40cf44db14694abac00e6b664e6>
- <https://git.kernel.org/stable/c/e813a0fc2e597146e9cebea61ced9c796d4e308f>
- <https://git.kernel.org/stable/c/03f5a999adba062456c8c818a683beb1b498983a>
- <https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2024-36913/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_