CVE-2024-25744

What it actually does

An untrusted virtual machine monitor can force the guest kernel to handle the int80 syscall at arbitrary times, bypassing intended protections in TDX and AMD SEV memory encryption paths and enabling privilege escalation within the guest.

Why it matters to the business

Virtualized Linux systems on affected kernels face elevated risk of guest-to-hypervisor or intra-guest privilege escalation, potentially leading to data theft, service disruption, or ransomware deployment in multi-tenant environments; the low EPSS and lack of known exploitation reduce immediate urgency but the long time since disclosure means unpatched systems remain exposed.

How an attack unfolds

An attacker controlling or compromising the VMM crafts conditions that invoke int80 handling outside normal entry points in the TDX or AMD SEV code paths, allowing the guest kernel to execute privileged operations at attacker-chosen moments and escalate privileges.

How to fix it

Upgrade the Linux kernel to version 6.6.7 or later, or apply the fix from commit b82a8dbd3d2f4563156f7150c6f2ecab6e960b30 in the mainline repository; rebuild and reboot all affected systems.

How to confirm the fix worked

Verify the running kernel version is 6.6.7 or newer; confirm the presence of the commit b82a8dbd3d2f4563156f7150c6f2ecab6e960b30 in the kernel source tree or check for the patched TDX and mem_encrypt_amd logic.

Typical attack path

1. Gain control of or influence the untrusted VMM
2. Trigger int80 syscall handling at a chosen execution point inside the guest
3. Exploit resulting inconsistent state to obtain elevated privileges
4. Execute payload or access restricted resources

How to detect it

Review kernel logs and hypervisor audit trails for unexpected int80 entries or TDX/SEV related faults around the time of suspected compromise; correlate with process creation or privilege changes in guest systems.

What your security team should do

• Prioritize kernel upgrades on all virtualization hosts and guests within the next patching cycle
• Audit virtualization configurations to ensure VMMs are trusted or isolated
• Monitor for new exploit code given the public disclosure