CVE-2024-35791

What it actually does

Use-after-free in svm_register_enc_region() where the region structure or its dynamically allocated pages array can be freed by a concurrent task after kvm->lock is dropped but before the cache flush completes on systems lacking encrypted memory coherency.

Why it matters to the business

In virtualized Linux environments using AMD SVM with encrypted memory features, this can lead to host kernel instability, crashes, or potential code execution affecting multiple VMs; low immediate urgency as it is not known to be exploited in the wild or used in ransomware.

How an attack unfolds

An attacker with sufficient privileges to manage KVM encrypted regions registers a region, then arranges for __unregister_enc_region_locked() to execute concurrently from another task; the original flow drops the lock before flushing, allowing the freed region or pages to be accessed during the flush operation.

How to fix it

Upgrade the Linux kernel to a version containing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be or later; apply the fix that moves the page cache flush before dropping kvm->lock.

How to confirm the fix worked

Verify the presence of commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be in the kernel source or confirm the fix is present by inspecting svm_register_enc_region() to ensure the flush occurs while kvm->lock is still held.

Typical attack path

1. Obtain capability to call KVM encrypted region registration ioctls
2. Register an encrypted memory region under kvm->lock
3. Trigger concurrent unregister from userspace or another task
4. Cause the original task to perform cache flush after the region/pages have been freed
5. Leverage the resulting UAF for memory corruption or information disclosure

How to detect it

Review kernel logs for KVM SVM encrypted region registration/unregistration activity around any observed crashes or UAF reports; correlate with process activity performing KVM ioctls on affected kernels.

What your security team should do

• Apply the referenced kernel commit to all systems running KVM with AMD SVM encrypted memory support
• Prioritize patching in environments with high VM density or SEV/SEV-ES usage
• Monitor for any new public exploits given the 880 days since disclosure