CVE-2024-35875

What it actually does

The vulnerability allows CoCo (confidential compute) x86 systems to boot without seeding the kernel RNG from RDRAND, leaving the RNG potentially unseeded or weak when the untrusted host can observe or manipulate other entropy sources.

Why it matters to the business

Confidential workloads on affected Linux kernels may start with insufficient randomness, increasing the risk of cryptographic failures or secret exposure in production confidential VMs; the issue affects a widely used kernel component with high ecosystem prevalence.

How an attack unfolds

An attacker controlling the host of a CoCo guest manipulates or observes all non-RDRAND entropy sources at boot; if RDRAND is absent or faulty the guest RNG initializes without sufficient entropy, allowing subsequent prediction of cryptographic material or manipulation of guest computation that depends on randomness.

How to fix it

Upgrade the Linux kernel to a version containing commit 22943e4fe4b3a2dcbadc3d38d5bf840bbdbfe374 or later; ensure RDRAND is functional on all CoCo x86 systems and test that boot panics occur when RDRAND seeding fails.

How to confirm the fix worked

Boot a CoCo-enabled kernel with the fix applied and confirm that dmesg or early boot logs contain the RDRAND seeding message; deliberately disable RDRAND (via CPU feature mask or hardware) and verify the kernel panics as intended.

Typical attack path

1. Compromise or control the hypervisor hosting the CoCo VM
2. Prevent or tamper with all guest-visible entropy sources except RDRAND
3. Boot the guest so that RNG initialization skips or fails RDRAND seeding
4. Observe or brute-force cryptographic operations that rely on the weak RNG state

How to detect it

Examine early kernel boot logs on CoCo systems for missing RDRAND seeding messages or RNG initialization warnings; correlate with hypervisor audit logs showing entropy source manipulation or RDRAND CPU feature masking.

What your security team should do

• Prioritize patching all confidential-compute Linux instances within the next maintenance window due to the 878-day exposure window
• Verify RDRAND availability and functionality on every CoCo host before deployment
• Add boot-time checks and monitoring for RNG initialization success on confidential workloads
• Review downstream distributions and containers for inclusion of the referenced commit