CVE-2024-36911

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

The attacker is the untrusted hypervisor/host, which reaches the guest only through the paravirtualized VMBus/hypercall interface rather than any network stack; from the guest's perspective this is the local virtual-hardware path (`tdx_map_gpa()` / `hv_mark_gpa_visibility()` return values). No network, adjacent-network, or physical access to the guest is involved.

AC:LAttack complexity, low

The host deterministically controls the outcome — it simply returns an error from the TDVMCALL<MapGPA> or HVCALL_MODIFY_SPARSE_GPA_PAGE_HOST_VISIBILITY hypercall at a moment of its choosing, and the PTE encryption bit has already been cleared by `__change_page_attr_set_clr()` before that call. It can also force unlimited retries via suspend/resume and VF hot-plug cycles, so nothing depends on conditions outside its control.

PR:NPrivileges required, none

In the confidential-computing threat model the host holds zero privileges inside the guest — that is the entire premise of TDX/SEV-SNP — and needs no guest account or capability to fail the conversion hypercall. The vulnerable path runs at netvsc probe during guest boot with no guest-side authentication.

UI:NUser interaction, none

The GPADL for the receive/send buffers is established automatically during `netvsc_init_buf()` at driver probe on every guest boot, and the host can independently drive further detach/attach cycles via `netvsc_suspend`/`netvsc_resume`. No guest user action is required.

S:UScope, unchanged

The impacted resources are guest kernel and guest userspace memory, which fall under the same security authority as the vulnerable component (the guest Linux kernel). This is a host-to-guest attack, not an escape from the vulnerable component's scope such as a guest-to-host breakout.

C:HConfidentiality impact, high

Up to 46MB of still-shared pages are returned to the buddy allocator and recycled for arbitrary kernel and user data, which the untrusted host can then read in plaintext — keys, credentials, and any guest secret that lands in those pages. This is a total loss of confidential-VM confidentiality, repeatable across reinit cycles.

I:HIntegrity impact, high

The same pages remain host-*writable*, so the host can modify arbitrary reallocated slab objects, page-cache contents, and function pointers in the guest, yielding an arbitrary-write primitive and code execution inside the guest kernel.

A:HAvailability impact, high

Guest reuse of pages whose private/shared state disagrees with the guest's expectation triggers #VE/#VC exceptions and memory corruption in arbitrary recycled kernel structures, leading to guest kernel panic. The host can induce this at will.