CVE-2024-57793 in Linux
Summary
by MITRE • 01/11/2025
In the Linux kernel, the following vulnerability has been resolved:
virt: tdx-guest: Just leak decrypted memory on unrecoverable errors
In CoCo VMs it is possible for the untrusted host to cause set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues.
Leak the decrypted memory when set_memory_decrypted() fails, and don't need to print an error since set_memory_decrypted() will call WARN_ONCE().
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability identified as CVE-2024-57793 resides within the Linux kernel's virtualization subsystem, specifically affecting TDX (Trusted Domain Extensions) guest implementations. This flaw manifests in Confidential Computing environments where the untrusted host system can manipulate memory operations to cause failures in the decryption process. The issue occurs within the virt subsystem's TDX guest support code, where the set_memory_decrypted() function fails to properly handle error conditions during memory management operations.
The technical root cause involves improper error handling in the memory decryption process for Confidential Computing Virtual Machines. When the set_memory_decrypted() function encounters unrecoverable errors, it returns an error code but fails to properly manage the memory state, resulting in decrypted memory being shared rather than properly handled. This creates a scenario where memory that should remain encrypted becomes accessible to the host system, potentially exposing sensitive data. The vulnerability is particularly concerning because it operates at the kernel level within virtualization contexts where memory isolation is paramount for security.
The operational impact of this vulnerability extends beyond simple memory management issues to encompass significant security implications within Confidential Computing environments. When decrypted memory is improperly shared with the untrusted host, it creates potential data leakage channels that could compromise the confidentiality guarantees that Confidential Computing is designed to provide. The flaw essentially undermines the security boundary between guest and host systems, allowing for information disclosure that could expose sensitive cryptographic keys, application data, or system configurations. This represents a direct violation of the fundamental security principles that Confidential Computing platforms are meant to enforce.
The vulnerability aligns with CWE-248, which addresses "Uncaught Exception" in software systems, and relates to ATT&CK technique T1552.001 for "Unsecured Credentials" through potential exposure of sensitive data. The implementation flaw specifically involves improper handling of memory state transitions during decryption failures, creating a persistent security vulnerability. The kernel developers have addressed this by implementing a memory leak strategy rather than attempting to return corrupted memory to the page allocator, which prevents the system from potentially exposing decrypted data through memory reuse operations. This approach eliminates the risk of returning decrypted memory to the page allocator while maintaining system stability.
Mitigation strategies for CVE-2024-57793 focus on ensuring proper kernel updates and maintaining current security patches for virtualization environments. Organizations running Confidential Computing workloads should prioritize immediate patching of affected kernel versions and implement monitoring for potential memory management anomalies. The fix addresses the core issue by ensuring that when memory decryption fails, the system leaks the decrypted memory rather than attempting to return it to the allocator, thereby preventing the exposure of sensitive data. Additionally, system administrators should verify that their TDX guest configurations properly handle error conditions and consider implementing additional monitoring for memory management operations within virtualized environments to detect potential exploitation attempts.