CVE-2024-46794

x86/tdx: Fix data leak in mmio_read()

Description

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix data leak in mmio_read() The mmio_read() function makes a TDVMCALL to retrieve MMIO data for an address from the VMM. Sean noticed that mmio_read() unintentionally exposes the value of an initialized variable (val) on the stack to the VMM. This variable is only needed as an output value. It did not need to be passed to the VMM in the first place. Do not send the original value of *val to the VMM. [ dhansen: clarify what 'val' is used for. ]

3.3

CVSS

Severity: Low

CVSS 3.1 •

EPSS 0.02%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/26c6af49d26ffc377e392e30d4086db19eed0ef7	patch
https://git.kernel.org/stable/c/ef00818c50cf55a3a56bd9a9fae867c92dfb84e7	patch
https://git.kernel.org/stable/c/b55ce742afcb8e8189d82f2f1e635ba1b5a461fa	patch
https://git.kernel.org/stable/c/b6fb565a2d15277896583d471b21bc14a0c99661	patch

Frequently Asked Questions

What is the severity of CVE-2024-46794?: CVE-2024-46794 has been scored as a low severity vulnerability.
How to fix CVE-2024-46794?: To fix CVE-2024-46794, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-46794 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-46794 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-46794?: CVE-2024-46794 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.