CVE-2024-35814

What it actually does

Broken alignment handling in swiotlb allows page-unaligned slot allocations from dma_alloc_coherent when previous allocations leave area->index misaligned, causing swiotlb_alloc to return a pointer to the same struct page twice and double-allocate the first half of a 4KiB page, resulting in buffer corruption.

Why it matters to the business

Virtual machines using vsock or other virtio devices with restricted DMA SWIOTLB pools can experience data corruption, device hangs, or system instability, disrupting workloads that rely on DMA bouncing.

How an attack unfolds

An attacker with local access or control of a guest VM triggers repeated dma_alloc_coherent calls for virtqueues or similar buffers; the misaligned slot search returns overlapping addresses that the kernel treats as distinct pages, leading to corruption when the overlapping region is written. The listed Android kernel threat actor context is not applicable to this local Linux kernel flaw.

How to fix it

Upgrade the Linux kernel to the fixed commit 3e7acd6e25ba77dde48c3b721c54c89cd6a10534 or later stable release containing the corrected alignment logic that separates device alignment from page alignment requirements.

How to confirm the fix worked

Confirm the running kernel contains commit 3e7acd6e25ba77dde48c3b721c54c89cd6a10534; reproduce the vsock virtqueue allocation pattern and verify that returned SWIOTLB addresses are page-aligned and that no double-mapping occurs.

Typical attack path

1. Obtain local code execution or guest VM control on an affected Linux kernel
2. Allocate multiple coherent DMA buffers via virtio or similar devices to misalign the SWIOTLB index
3. Trigger a subsequent allocation whose returned address overlaps a prior page
4. Write to the overlapping buffer region to corrupt kernel or device data
5. Observe or escalate via resulting corruption or hang

How to detect it

Review kernel logs for swiotlb allocation messages showing non-page-aligned addresses followed by corruption or hangs; examine dmesg output for virtio-pci slot allocation traces matching the described pattern of consecutive overlapping 2KiB regions.

What your security team should do

• Prioritize kernel updates on systems using virtio devices with SWIOTLB DMA pools
• Monitor vendor advisories for backported fixes in distribution kernels
• Restrict untrusted local access or guest VM capabilities until patched