Linux Kernel TDX Guest Decrypted Memory Leak Vulnerability

A vulnerability in the Linux kernel's handling of decrypted memory in TDX guest virtual machines has been addressed. In CoCo VMs, an untrusted host can cause the 'set_memory_decrypted()' function to fail, leading to a leak of decrypted memory that is shared. This situation arises because the error is not properly managed, allowing decrypted memory to be returned to the page allocator, potentially causing functional or security problems. The vulnerability involves leaking decrypted memory when 'set_memory_decrypted()' fails, without printing an error, since 'set_memory_decrypted()' will already call 'WARN_ONCE()'.

Impact

The vulnerability could lead to unintended sharing of decrypted memory, which may cause functional or security issues.