{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2024-57793",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-01-11T12:32:49.384Z",
        "datePublished": "2025-01-11T12:39:47.347Z",
        "dateUpdated": "2026-08-05T11:46:33.664Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T11:46:33.664Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: tdx-guest: Just leak decrypted memory on unrecoverable errors\n\nIn CoCo VMs it is possible for the untrusted host to cause\nset_memory_decrypted() to fail such that an error is returned\nand the resulting memory is shared. Callers need to take care\nto handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional\nor security issues.\n\nLeak the decrypted memory when set_memory_decrypted() fails,\nand don't need to print an error since set_memory_decrypted()\nwill call WARN_ONCE()."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                        "baseScore": 9.3,
                        "baseSeverity": "CRITICAL"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The attacker is the untrusted hypervisor/VMM, which reaches the vulnerable code through the TDVMCALL<MapGPA> interface of the guest it hosts — not via any network stack. This matches the established scoring for CoCo host-to-guest issues in this subsystem (CVE-2026-64104, CVE-2026-52959, CVE-2025-38560).\nAC:L - The VMM implements the MapGPA handler and can deterministically fail it (non-zero status, or three STATUS_RETRY responses with an unchanged r11), forcing set_memory_decrypted() to return an error every time. No race, timing, or memory-layout condition outside the attacker's control is involved.\nPR:N - alloc_quote_buf() is reached only from tdx_guest_init() at module load during guest boot, so the host needs no credentials, account, or capability inside the guest at all. The hypervisor is entirely outside the guest's authentication domain in the TDX threat model.\nUI:N - The vulnerable path executes automatically when the tdx-guest driver initializes at boot; no guest user or administrator has to perform any action.\nS:C - Returning shared pages to the buddy allocator breaks the hardware-enforced TDX confidential-computing boundary, so data belonging to every other authority in the guest (all processes, containers, and the guest's protected TCB) becomes readable and writable by the hypervisor — impact well beyond the tdx-guest driver's own scope, consistent with CVE-2026-64104.\nC:H - The recycled pages alias host-visible shared memory, so anything the guest later places there — slab objects, page cache, anonymous user data, cryptographic keys — is exposed in plaintext to the untrusted host, giving a persistent, repeatedly refreshed arbitrary-read window into guest memory.\nI:H - The host can write those pages at will while they hold live kernel or user data, yielding an arbitrary-write primitive into whatever object currently occupies them (kernel structures with function pointers or list heads), which is leverageable for control-flow hijack inside the guest.\nA:H - Host modification of live kernel objects in the recycled pages, plus the private/shared state mismatch left by the failed conversion (#VE / EPT violation on kernel accesses), reliably produces guest kernel corruption and panic."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/virt/coco/tdx-guest/tdx-guest.c"
                    ],
                    "versions": [
                        {
                            "version": "f4738f56d1dc62aaba69b33702a5ab098f1b8c63",
                            "lessThan": "1429ae7b7d4759a1e362456b8911c701bae655b4",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "f4738f56d1dc62aaba69b33702a5ab098f1b8c63",
                            "lessThan": "27834971f616c5e154423c578fa95e0444444ce1",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/virt/coco/tdx-guest/tdx-guest.c"
                    ],
                    "versions": [
                        {
                            "version": "6.7",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.7",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.8",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.13",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.7",
                                    "versionEndExcluding": "6.12.8"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.7",
                                    "versionEndExcluding": "6.13"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/1429ae7b7d4759a1e362456b8911c701bae655b4"
                },
                {
                    "url": "https://git.kernel.org/stable/c/27834971f616c5e154423c578fa95e0444444ce1"
                }
            ],
            "title": "virt: tdx-guest: Just leak decrypted memory on unrecoverable errors",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}