CVE-2024-35791 (GCVE-0-2024-35791)

Vulnerability from cvelistv5 – Published: 2024-05-17 12:24 – Updated: 2026-05-23 15:43
VLAI
Title
KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() Do the cache flush of converted pages in svm_register_enc_region() before dropping kvm->lock to fix use-after-free issues where region and/or its array of pages could be freed by a different task, e.g. if userspace has __unregister_enc_region_locked() already queued up for the region. Note, the "obvious" alternative of using local variables doesn't fully resolve the bug, as region->pages is also dynamically allocated. I.e. the region structure itself would be fine, but region->pages could be freed. Flushing multiple pages under kvm->lock is unfortunate, but the entire flow is a rare slow path, and the manual flush is only needed on CPUs that lack coherency for encrypted memory.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 4f627ecde7329e476a077bb0590db8f27bb8f912 , < 2d13b79640b147bd77c34a5998533b2021a4122d (git)
Affected: 19a23da53932bc8011220bd8c410cb76012de004 , < e126b508ed2e616d679d85fca2fbe77bb48bbdd7 (git)
Affected: 19a23da53932bc8011220bd8c410cb76012de004 , < 4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865 (git)
Affected: 19a23da53932bc8011220bd8c410cb76012de004 , < 12f8e32a5a389a5d58afc67728c76e61beee1ad4 (git)
Affected: 19a23da53932bc8011220bd8c410cb76012de004 , < f6d53d8a2617dd58c89171a6b9610c470ebda38a (git)
Affected: 19a23da53932bc8011220bd8c410cb76012de004 , < 5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807 (git)
Affected: f1ecde00ce1694597f923f0d25f7a797c5243d99 (git)
Affected: 848bcb0a1d96f67d075465667d3a1ad4af56311e (git)
Affected: 5.10.15 , < 5.10.215 (semver)
Affected: 4.19.176 , < 4.20 (semver)
Affected: 5.4.98 , < 5.5 (semver)
Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.10.215 , ≤ 5.10.* (semver)
Unaffected: 5.15.154 , ≤ 5.15.* (semver)
Unaffected: 6.1.84 , ≤ 6.1.* (semver)
Unaffected: 6.6.24 , ≤ 6.6.* (semver)
Unaffected: 6.7.12 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:47.497Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2d13b79640b147bd77c34a5998533b2021a4122d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e126b508ed2e616d679d85fca2fbe77bb48bbdd7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/12f8e32a5a389a5d58afc67728c76e61beee1ad4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f6d53d8a2617dd58c89171a6b9610c470ebda38a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35791",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:42:51.101780Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:23.051Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2d13b79640b147bd77c34a5998533b2021a4122d",
              "status": "affected",
              "version": "4f627ecde7329e476a077bb0590db8f27bb8f912",
              "versionType": "git"
            },
            {
              "lessThan": "e126b508ed2e616d679d85fca2fbe77bb48bbdd7",
              "status": "affected",
              "version": "19a23da53932bc8011220bd8c410cb76012de004",
              "versionType": "git"
            },
            {
              "lessThan": "4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865",
              "status": "affected",
              "version": "19a23da53932bc8011220bd8c410cb76012de004",
              "versionType": "git"
            },
            {
              "lessThan": "12f8e32a5a389a5d58afc67728c76e61beee1ad4",
              "status": "affected",
              "version": "19a23da53932bc8011220bd8c410cb76012de004",
              "versionType": "git"
            },
            {
              "lessThan": "f6d53d8a2617dd58c89171a6b9610c470ebda38a",
              "status": "affected",
              "version": "19a23da53932bc8011220bd8c410cb76012de004",
              "versionType": "git"
            },
            {
              "lessThan": "5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807",
              "status": "affected",
              "version": "19a23da53932bc8011220bd8c410cb76012de004",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f1ecde00ce1694597f923f0d25f7a797c5243d99",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "848bcb0a1d96f67d075465667d3a1ad4af56311e",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.215",
              "status": "affected",
              "version": "5.10.15",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.176",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.98",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.215",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.215",
                  "versionStartIncluding": "5.10.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.154",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.84",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.176",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.98",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Flush pages under kvm-\u003elock to fix UAF in svm_register_enc_region()\n\nDo the cache flush of converted pages in svm_register_enc_region() before\ndropping kvm-\u003elock to fix use-after-free issues where region and/or its\narray of pages could be freed by a different task, e.g. if userspace has\n__unregister_enc_region_locked() already queued up for the region.\n\nNote, the \"obvious\" alternative of using local variables doesn\u0027t fully\nresolve the bug, as region-\u003epages is also dynamically allocated.  I.e. the\nregion structure itself would be fine, but region-\u003epages could be freed.\n\nFlushing multiple pages under kvm-\u003elock is unfortunate, but the entire\nflow is a rare slow path, and the manual flush is only needed on CPUs that\nlack coherency for encrypted memory."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:43:00.756Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2d13b79640b147bd77c34a5998533b2021a4122d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e126b508ed2e616d679d85fca2fbe77bb48bbdd7"
        },
        {
          "url": "https://git.kernel.org/stable/c/4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865"
        },
        {
          "url": "https://git.kernel.org/stable/c/12f8e32a5a389a5d58afc67728c76e61beee1ad4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6d53d8a2617dd58c89171a6b9610c470ebda38a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807"
        }
      ],
      "title": "KVM: SVM: Flush pages under kvm-\u003elock to fix UAF in svm_register_enc_region()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35791",
    "datePublished": "2024-05-17T12:24:49.520Z",
    "dateReserved": "2024-05-17T12:19:12.339Z",
    "dateUpdated": "2026-05-23T15:43:00.756Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35791",
      "date": "2026-05-26",
      "epss": "0.00028",
      "percentile": "0.08186"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: SVM: Flush pages under kvm-\u003elock to fix UAF in svm_register_enc_region()\\n\\nDo the cache flush of converted pages in svm_register_enc_region() before\\ndropping kvm-\u003elock to fix use-after-free issues where region and/or its\\narray of pages could be freed by a different task, e.g. if userspace has\\n__unregister_enc_region_locked() already queued up for the region.\\n\\nNote, the \\\"obvious\\\" alternative of using local variables doesn\u0027t fully\\nresolve the bug, as region-\u003epages is also dynamically allocated.  I.e. the\\nregion structure itself would be fine, but region-\u003epages could be freed.\\n\\nFlushing multiple pages under kvm-\u003elock is unfortunate, but the entire\\nflow is a rare slow path, and the manual flush is only needed on CPUs that\\nlack coherency for encrypted memory.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: SVM: Vaciar p\\u00e1ginas bajo kvm-\u0026gt;lock para arreglar UAF en svm_register_enc_region() Realice el vaciado de cach\\u00e9 de las p\\u00e1ginas convertidas en svm_register_enc_region() antes de eliminar kvm-\u0026gt;lock para arreglar el uso -Problemas posteriores a la liberaci\\u00f3n en los que la regi\\u00f3n y/o su conjunto de p\\u00e1ginas podr\\u00edan liberarse mediante una tarea diferente, por ejemplo, si el espacio de usuario ya tiene __unregister_enc_region_locked() en cola para la regi\\u00f3n. Tenga en cuenta que la alternativa \\\"obvia\\\" de usar variables locales no resuelve completamente el error, ya que regi\\u00f3n-\u0026gt;p\\u00e1ginas tambi\\u00e9n se asigna din\\u00e1micamente. Es decir, la estructura de la regi\\u00f3n en s\\u00ed estar\\u00eda bien, pero se podr\\u00edan liberar regiones-\u0026gt;p\\u00e1ginas. Vaciar varias p\\u00e1ginas bajo kvm-\u0026gt;lock es desafortunado, pero todo el flujo es un camino lento poco com\\u00fan, y el vaciado manual solo es necesario en CPU que carecen de coherencia para la memoria cifrada.\"}]",
      "id": "CVE-2024-35791",
      "lastModified": "2024-11-21T09:20:54.250",
      "published": "2024-05-17T13:15:58.873",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/12f8e32a5a389a5d58afc67728c76e61beee1ad4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/2d13b79640b147bd77c34a5998533b2021a4122d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e126b508ed2e616d679d85fca2fbe77bb48bbdd7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f6d53d8a2617dd58c89171a6b9610c470ebda38a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/12f8e32a5a389a5d58afc67728c76e61beee1ad4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/2d13b79640b147bd77c34a5998533b2021a4122d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/e126b508ed2e616d679d85fca2fbe77bb48bbdd7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f6d53d8a2617dd58c89171a6b9610c470ebda38a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35791\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T13:15:58.873\",\"lastModified\":\"2025-12-23T18:45:58.890\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: SVM: Flush pages under kvm-\u003elock to fix UAF in svm_register_enc_region()\\n\\nDo the cache flush of converted pages in svm_register_enc_region() before\\ndropping kvm-\u003elock to fix use-after-free issues where region and/or its\\narray of pages could be freed by a different task, e.g. if userspace has\\n__unregister_enc_region_locked() already queued up for the region.\\n\\nNote, the \\\"obvious\\\" alternative of using local variables doesn\u0027t fully\\nresolve the bug, as region-\u003epages is also dynamically allocated.  I.e. the\\nregion structure itself would be fine, but region-\u003epages could be freed.\\n\\nFlushing multiple pages under kvm-\u003elock is unfortunate, but the entire\\nflow is a rare slow path, and the manual flush is only needed on CPUs that\\nlack coherency for encrypted memory.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: SVM: Vaciar p\u00e1ginas bajo kvm-\u0026gt;lock para arreglar UAF en svm_register_enc_region() Realice el vaciado de cach\u00e9 de las p\u00e1ginas convertidas en svm_register_enc_region() antes de eliminar kvm-\u0026gt;lock para arreglar el uso -Problemas posteriores a la liberaci\u00f3n en los que la regi\u00f3n y/o su conjunto de p\u00e1ginas podr\u00edan liberarse mediante una tarea diferente, por ejemplo, si el espacio de usuario ya tiene __unregister_enc_region_locked() en cola para la regi\u00f3n. Tenga en cuenta que la alternativa \\\"obvia\\\" de usar variables locales no resuelve completamente el error, ya que regi\u00f3n-\u0026gt;p\u00e1ginas tambi\u00e9n se asigna din\u00e1micamente. Es decir, la estructura de la regi\u00f3n en s\u00ed estar\u00eda bien, pero se podr\u00edan liberar regiones-\u0026gt;p\u00e1ginas. Vaciar varias p\u00e1ginas bajo kvm-\u0026gt;lock es desafortunado, pero todo el flujo es un camino lento poco com\u00fan, y el vaciado manual solo es necesario en CPU que carecen de coherencia para la memoria cifrada.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.176\",\"versionEndExcluding\":\"4.20\",\"matchCriteriaId\":\"431F7799-C3BC-460E-9A3F-7C2DA6D37216\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.98\",\"versionEndExcluding\":\"5.5\",\"matchCriteriaId\":\"61592AB5-E211-43FF-8AC4-BF2F575C8CC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.15\",\"versionEndExcluding\":\"5.10.215\",\"matchCriteriaId\":\"D51DB3B8-8791-493A-AD50-68977535E7D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11.1\",\"versionEndExcluding\":\"5.15.154\",\"matchCriteriaId\":\"0CBA0E6F-C94F-4969-AE1F-62236EBE4246\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.84\",\"matchCriteriaId\":\"834D9BD5-42A6-4D74-979E-4D6D93F630FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.24\",\"matchCriteriaId\":\"8018C1D0-0A5F-48D0-BC72-A2B33FDDA693\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.12\",\"matchCriteriaId\":\"6BE9771A-BAFD-4624-95F9-58D536540C53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.11:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"7AD3510E-E8FA-47F3-9AD5-D8EA4A2719D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.11:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"E9FA9D80-C790-41EA-8A21-DF7B170465E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A780F817-2A77-4130-A9B7-5C25606314E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"AEB9199B-AB8F-4877-8964-E2BA95B5F15C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9B8A5CE-6D20-4C36-AC01-ACA4B70003A8\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/12f8e32a5a389a5d58afc67728c76e61beee1ad4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2d13b79640b147bd77c34a5998533b2021a4122d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e126b508ed2e616d679d85fca2fbe77bb48bbdd7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f6d53d8a2617dd58c89171a6b9610c470ebda38a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/12f8e32a5a389a5d58afc67728c76e61beee1ad4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2d13b79640b147bd77c34a5998533b2021a4122d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e126b508ed2e616d679d85fca2fbe77bb48bbdd7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f6d53d8a2617dd58c89171a6b9610c470ebda38a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2d13b79640b147bd77c34a5998533b2021a4122d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e126b508ed2e616d679d85fca2fbe77bb48bbdd7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/12f8e32a5a389a5d58afc67728c76e61beee1ad4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f6d53d8a2617dd58c89171a6b9610c470ebda38a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:47.497Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35791\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:42:51.101780Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:16.429Z\"}}], \"cna\": {\"title\": \"KVM: SVM: Flush pages under kvm-\u003elock to fix UAF in svm_register_enc_region()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4f627ecde7329e476a077bb0590db8f27bb8f912\", \"lessThan\": \"2d13b79640b147bd77c34a5998533b2021a4122d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"19a23da53932bc8011220bd8c410cb76012de004\", \"lessThan\": \"e126b508ed2e616d679d85fca2fbe77bb48bbdd7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"19a23da53932bc8011220bd8c410cb76012de004\", \"lessThan\": \"4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"19a23da53932bc8011220bd8c410cb76012de004\", \"lessThan\": \"12f8e32a5a389a5d58afc67728c76e61beee1ad4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"19a23da53932bc8011220bd8c410cb76012de004\", \"lessThan\": \"f6d53d8a2617dd58c89171a6b9610c470ebda38a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"19a23da53932bc8011220bd8c410cb76012de004\", \"lessThan\": \"5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f1ecde00ce1694597f923f0d25f7a797c5243d99\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"848bcb0a1d96f67d075465667d3a1ad4af56311e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.10.15\", \"lessThan\": \"5.10.215\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.19.176\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.4.98\", \"lessThan\": \"5.5\", \"versionType\": \"semver\"}], \"programFiles\": [\"arch/x86/kvm/svm/sev.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.215\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.154\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.84\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.24\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/x86/kvm/svm/sev.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2d13b79640b147bd77c34a5998533b2021a4122d\"}, {\"url\": \"https://git.kernel.org/stable/c/e126b508ed2e616d679d85fca2fbe77bb48bbdd7\"}, {\"url\": \"https://git.kernel.org/stable/c/4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865\"}, {\"url\": \"https://git.kernel.org/stable/c/12f8e32a5a389a5d58afc67728c76e61beee1ad4\"}, {\"url\": \"https://git.kernel.org/stable/c/f6d53d8a2617dd58c89171a6b9610c470ebda38a\"}, {\"url\": \"https://git.kernel.org/stable/c/5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: SVM: Flush pages under kvm-\u003elock to fix UAF in svm_register_enc_region()\\n\\nDo the cache flush of converted pages in svm_register_enc_region() before\\ndropping kvm-\u003elock to fix use-after-free issues where region and/or its\\narray of pages could be freed by a different task, e.g. if userspace has\\n__unregister_enc_region_locked() already queued up for the region.\\n\\nNote, the \\\"obvious\\\" alternative of using local variables doesn\u0027t fully\\nresolve the bug, as region-\u003epages is also dynamically allocated.  I.e. the\\nregion structure itself would be fine, but region-\u003epages could be freed.\\n\\nFlushing multiple pages under kvm-\u003elock is unfortunate, but the entire\\nflow is a rare slow path, and the manual flush is only needed on CPUs that\\nlack coherency for encrypted memory.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.215\", \"versionStartIncluding\": \"5.10.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.154\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.84\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.24\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.12\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.19.176\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.4.98\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:43:00.756Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35791\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:43:00.756Z\", \"dateReserved\": \"2024-05-17T12:19:12.339Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T12:24:49.520Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.