CVE-2024-35939

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-35939", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.131Z", "datePublished": "2024-05-19T10:10:44.931Z", "dateUpdated": "2026-08-05T11:31:06.443Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:31:06.443Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-direct: Leak pages on dma_set_decrypted() failure\n\nOn TDX it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nDMA could free decrypted/shared pages if dma_set_decrypted() fails. This\nshould be a rare case. Just leak the pages in this case instead of\nfreeing them."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.3, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:L - The attacker is the untrusted hypervisor/VMM, which reaches the vulnerable code through the local hypercall/VM-exit interface (`TDVMCALL_MAP_GPA`) rather than any network stack. This is a platform-local attack surface directly beneath the guest kernel, not a remote or network-adjacent one.\nAC:L - The VMM deterministically controls the `TDVMCALL_MAP_GPA` return value and can fail it (or force three no-progress retries) at will, after the guest PTEs have already been flipped to the shared alias; it can also force repeated DMA allocations via device hotplug or guest I/O. No race, memory-layout grooming, or condition outside the attacker's control is required, and CONFIG_INTEL_TDX_GUEST/CONFIG_AMD_MEM_ENCRYPT are enabled by default in all mainstream distro and cloud guest kernels.\nPR:N - The malicious host holds zero privileges within the vulnerable component (the confidential guest kernel) \u2014 the entire premise of TDX/SEV is that the hypervisor is untrusted and unauthorized with respect to guest memory. No guest credentials, account, or authentication are involved, and the triggering DMA allocations occur autonomously during boot and host-initiated device probe.\nUI:N - No action by any guest user is needed; the host triggers coherent DMA allocations itself through virtual device hotplug or normal driver initialization, then fails the conversion hypercall.\nS:C - The flaw breaks the hardware-enforced confidential-computing isolation boundary, causing guest-private pages protected by the TDX module / AMD-SP security authority to be returned to the guest allocator while mapped into the host-controlled shared alias. Resources under the guest's protection domain become readable and writable by a component in an entirely separate security authority, analogous to a DMA/IOMMU boundary bypass.\nC:H - Pages leaked into the buddy allocator are subsequently reused for kernel slab objects, page tables, page cache, and user anonymous memory, all of which the untrusted host can read directly through the shared EPT/NPT mapping. This yields arbitrary disclosure of guest-private secrets \u2014 keys, credentials, and tenant workload data \u2014 the exact asset confidential computing exists to protect.\nI:H - The host controls the memory backing the shared alias and can write arbitrary content into pages the guest believes are private, producing an arbitrary kernel-memory write primitive inside the guest. When such a page is reused as slab, page tables, or executable page cache, this escalates to full control-flow hijack and code execution within the confidential guest.\nA:H - The failure path triggers `WARN_ONCE` in `__set_memory_enc_pgtable()` (immediate panic under panic_on_warn, which security-focused CoCo deployments are advised to enable), and host-controlled or unmapped pages circulating in the guest's page allocator readily cause oopses, corruption-induced panics, and unrecoverable faults. The DMA allocation itself also fails, breaking device operation."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/dma/direct.c"], "versions": [{"version": "56fccf21d1961a06e2a0c96ce446ebf036651062", "lessThan": "4e0cfb25d49da2e6261ad582f58ffa5b5dd8c8e9", "status": "affected", "versionType": "git"}, {"version": "56fccf21d1961a06e2a0c96ce446ebf036651062", "lessThan": "4031b72ca747a1e6e9ae4fa729e765b43363d66a", "status": "affected", "versionType": "git"}, {"version": "56fccf21d1961a06e2a0c96ce446ebf036651062", "lessThan": "b57326c96b7bc7638aa8c44e12afa2defe0c934c", "status": "affected", "versionType": "git"}, {"version": "56fccf21d1961a06e2a0c96ce446ebf036651062", "lessThan": "b9fa16949d18e06bdf728a560f5c8af56d2bdcaf", "status": "affected", "versionType": "git"}, {"version": "91c7b0407ca6a62c095d265f76926b67bf66c026", "status": "affected", "versionType": "git"}, {"version": "5.7.7", "lessThan": "5.8", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/dma/direct.c"], "versions": [{"version": "5.8", "status": "affected"}, {"version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.86", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.27", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.6", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.1.86"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.6.27"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.8.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7.7"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4e0cfb25d49da2e6261ad582f58ffa5b5dd8c8e9"}, {"url": "https://git.kernel.org/stable/c/4031b72ca747a1e6e9ae4fa729e765b43363d66a"}, {"url": "https://git.kernel.org/stable/c/b57326c96b7bc7638aa8c44e12afa2defe0c934c"}, {"url": "https://git.kernel.org/stable/c/b9fa16949d18e06bdf728a560f5c8af56d2bdcaf"}], "title": "dma-direct: Leak pages on dma_set_decrypted() failure", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35939", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-20T14:32:53.392867Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:34:33.840Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:49.028Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/4e0cfb25d49da2e6261ad582f58ffa5b5dd8c8e9", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4031b72ca747a1e6e9ae4fa729e765b43363d66a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b57326c96b7bc7638aa8c44e12afa2defe0c934c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b9fa16949d18e06bdf728a560f5c8af56d2bdcaf", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/4e0cfb25d49da2e6261ad582f58ffa5b5dd8c8e9", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4031b72ca747a1e6e9ae4fa729e765b43363d66a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b57326c96b7bc7638aa8c44e12afa2defe0c934c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b9fa16949d18e06bdf728a560f5c8af56d2bdcaf", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:49.028Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35939", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-20T14:32:53.392867Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:24.857Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "dma-direct: Leak pages on dma_set_decrypted() failure", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The attacker is the untrusted hypervisor/VMM, which reaches the vulnerable code through the local hypercall/VM-exit interface (`TDVMCALL_MAP_GPA`) rather than any network stack. This is a platform-local attack surface directly beneath the guest kernel, not a remote or network-adjacent one.\nAC:L - The VMM deterministically controls the `TDVMCALL_MAP_GPA` return value and can fail it (or force three no-progress retries) at will, after the guest PTEs have already been flipped to the shared alias; it can also force repeated DMA allocations via device hotplug or guest I/O. No race, memory-layout grooming, or condition outside the attacker's control is required, and CONFIG_INTEL_TDX_GUEST/CONFIG_AMD_MEM_ENCRYPT are enabled by default in all mainstream distro and cloud guest kernels.\nPR:N - The malicious host holds zero privileges within the vulnerable component (the confidential guest kernel) \u2014 the entire premise of TDX/SEV is that the hypervisor is untrusted and unauthorized with respect to guest memory. No guest credentials, account, or authentication are involved, and the triggering DMA allocations occur autonomously during boot and host-initiated device probe.\nUI:N - No action by any guest user is needed; the host triggers coherent DMA allocations itself through virtual device hotplug or normal driver initialization, then fails the conversion hypercall.\nS:C - The flaw breaks the hardware-enforced confidential-computing isolation boundary, causing guest-private pages protected by the TDX module / AMD-SP security authority to be returned to the guest allocator while mapped into the host-controlled shared alias. Resources under the guest's protection domain become readable and writable by a component in an entirely separate security authority, analogous to a DMA/IOMMU boundary bypass.\nC:H - Pages leaked into the buddy allocator are subsequently reused for kernel slab objects, page tables, page cache, and user anonymous memory, all of which the untrusted host can read directly through the shared EPT/NPT mapping. This yields arbitrary disclosure of guest-private secrets \u2014 keys, credentials, and tenant workload data \u2014 the exact asset confidential computing exists to protect.\nI:H - The host controls the memory backing the shared alias and can write arbitrary content into pages the guest believes are private, producing an arbitrary kernel-memory write primitive inside the guest. When such a page is reused as slab, page tables, or executable page cache, this escalates to full control-flow hijack and code execution within the confidential guest.\nA:H - The failure path triggers `WARN_ONCE` in `__set_memory_enc_pgtable()` (immediate panic under panic_on_warn, which security-focused CoCo deployments are advised to enable), and host-controlled or unmapped pages circulating in the guest's page allocator readily cause oopses, corruption-induced panics, and unrecoverable faults. The DMA allocation itself also fails, breaking device operation."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "56fccf21d1961a06e2a0c96ce446ebf036651062", "lessThan": "4e0cfb25d49da2e6261ad582f58ffa5b5dd8c8e9", "versionType": "git"}, {"status": "affected", "version": "56fccf21d1961a06e2a0c96ce446ebf036651062", "lessThan": "4031b72ca747a1e6e9ae4fa729e765b43363d66a", "versionType": "git"}, {"status": "affected", "version": "56fccf21d1961a06e2a0c96ce446ebf036651062", "lessThan": "b57326c96b7bc7638aa8c44e12afa2defe0c934c", "versionType": "git"}, {"status": "affected", "version": "56fccf21d1961a06e2a0c96ce446ebf036651062", "lessThan": "b9fa16949d18e06bdf728a560f5c8af56d2bdcaf", "versionType": "git"}, {"status": "affected", "version": "91c7b0407ca6a62c095d265f76926b67bf66c026", "versionType": "git"}, {"status": "affected", "version": "5.7.7", "lessThan": "5.8", "versionType": "semver"}], "programFiles": ["kernel/dma/direct.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"status": "unaffected", "version": "0", "lessThan": "5.8", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.86", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.27", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.6", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/dma/direct.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/4e0cfb25d49da2e6261ad582f58ffa5b5dd8c8e9"}, {"url": "https://git.kernel.org/stable/c/4031b72ca747a1e6e9ae4fa729e765b43363d66a"}, {"url": "https://git.kernel.org/stable/c/b57326c96b7bc7638aa8c44e12afa2defe0c934c"}, {"url": "https://git.kernel.org/stable/c/b9fa16949d18e06bdf728a560f5c8af56d2bdcaf"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-direct: Leak pages on dma_set_decrypted() failure\n\nOn TDX it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nDMA could free decrypted/shared pages if dma_set_decrypted() fails. This\nshould be a rare case. Just leak the pages in this case instead of\nfreeing them."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.86", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.27", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.6", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.7.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:31:06.443Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35939", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:31:06.443Z", "dateReserved": "2024-05-17T13:50:33.131Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-19T10:10:44.931Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/dma/direct.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4e0cfb25d49da2e6261ad582f58ffa5b5dd8c8e9", "status": "affected", "version": "56fccf21d1961a06e2a0c96ce446ebf036651062", "versionType": "git"}, {"lessThan": "4031b72ca747a1e6e9ae4fa729e765b43363d66a", "status": "affected", "version": "56fccf21d1961a06e2a0c96ce446ebf036651062", "versionType": "git"}, {"lessThan": "b57326c96b7bc7638aa8c44e12afa2defe0c934c", "status": "affected", "version": "56fccf21d1961a06e2a0c96ce446ebf036651062", "versionType": "git"}, {"lessThan": "b9fa16949d18e06bdf728a560f5c8af56d2bdcaf", "status": "affected", "version": "56fccf21d1961a06e2a0c96ce446ebf036651062", "versionType": "git"}, {"status": "affected", "version": "91c7b0407ca6a62c095d265f76926b67bf66c026", "versionType": "git"}, {"lessThan": "5.8", "status": "affected", "version": "5.7.7", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/dma/direct.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"lessThan": "5.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.86", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.27", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FE734CE8-823E-4412-B78D-CBCE2100A702", "versionEndExcluding": "6.1.86", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "41504EFE-0C3F-4B7C-B855-EFE4FA9ACB84", "versionEndExcluding": "6.6.27", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "22CA5433-1303-41EF-AD4C-F4645DC01541", "versionEndExcluding": "6.8.6", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-direct: Leak pages on dma_set_decrypted() failure\n\nOn TDX it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nDMA could free decrypted/shared pages if dma_set_decrypted() fails. This\nshould be a rare case. Just leak the pages in this case instead of\nfreeing them."}, {"lang": "es", "value": " En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dma-direct: p\u00e1ginas filtradas en el fallo de dma_set_decrypted() En TDX es posible que el host que no es de confianza provoque que set_memory_encrypted() o set_memory_decrypted() falle de modo que se devuelva un error y la memoria resultante se comparte. Las personas que llaman deben tener cuidado al manejar estos errores para evitar devolver memoria descifrada (compartida) al asignador de p\u00e1ginas, lo que podr\u00eda provocar problemas funcionales o de seguridad. DMA podr\u00eda liberar p\u00e1ginas descifradas/compartidas si dma_set_decrypted() falla. Este deber\u00eda ser un caso raro. En este caso, simplemente filtre las p\u00e1ginas en lugar de liberarlas."}], "id": "CVE-2024-35939", "lastModified": "2026-08-04T11:18:13.500", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-35939", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-20T14:32:53.392867Z", "version": "2.0.3"}}]}, "published": "2024-05-19T11:15:49.690", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4031b72ca747a1e6e9ae4fa729e765b43363d66a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4e0cfb25d49da2e6261ad582f58ffa5b5dd8c8e9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b57326c96b7bc7638aa8c44e12afa2defe0c934c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b9fa16949d18e06bdf728a560f5c8af56d2bdcaf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4031b72ca747a1e6e9ae4fa729e765b43363d66a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4e0cfb25d49da2e6261ad582f58ffa5b5dd8c8e9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b57326c96b7bc7638aa8c44e12afa2defe0c934c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b9fa16949d18e06bdf728a560f5c8af56d2bdcaf"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:8870", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-553.27.1.rt7.368.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-11-05T00:00:00Z"}, {"advisory": "RHSA-2024:8856", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.27.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-11-05T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2025:4342", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "kernel-0:5.14.0-427.66.1.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-04-30T00:00:00Z"}], "bugzilla": {"description": "kernel: dma-direct: Leak pages on dma_set_decrypted() failure", "id": "2281817", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281817"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndma-direct: Leak pages on dma_set_decrypted() failure\nOn TDX it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\nDMA could free decrypted/shared pages if dma_set_decrypted() fails. This\nshould be a rare case. Just leak the pages in this case instead of\nfreeing them."], "name": "CVE-2024-35939", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-35939\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-35939\nhttps://lore.kernel.org/linux-cve-announce/2024051919-CVE-2024-35939-f877@gregkh/T"], "threat_severity": "Low"}

{}