CVE-2024-35939

What it actually does

On TDX systems, failure of dma_set_decrypted() during DMA operations can leave decrypted/shared pages that would previously be freed back to the allocator; the fix leaks the pages instead to prevent functional or security issues from returning shared memory to the page allocator.

Why it matters to the business

Organizations running Linux kernels with TDX on affected versions face rare but potential memory corruption or exposure risks during DMA operations with untrusted hosts, requiring kernel updates that may involve downtime or testing for production systems.

How an attack unfolds

An attacker controlling the host in a TDX environment would need to force set_memory_decrypted() or set_memory_encrypted() to fail during DMA setup, causing the kernel to free decrypted pages; the vulnerability allowed those pages to be returned to the allocator where they could be reused unsafely.

How to fix it

Update the Linux kernel to a version containing commit 4e0cfb25d49da2e6261ad582f58ffa5b5dd8c8e9 or later; apply the fix across all affected stable branches and rebuild or reinstall the kernel package.

How to confirm the fix worked

Verify the running kernel contains commit 4e0cfb25d49da2e6261ad582f58ffa5b5dd8c8e9 via git log or kernel version strings; test DMA paths under TDX with induced encryption failures to confirm pages are leaked rather than freed.

Typical attack path

1. Control or influence the untrusted host to induce failure in memory encryption state changes
2. Trigger DMA operations that call dma_set_decrypted()
3. Exploit freed decrypted pages being returned to the page allocator for reuse

How to detect it

Examine kernel logs for DMA and memory encryption error paths around set_memory_decrypted failures; look for unexpected page allocator behavior or TDX-related warnings in dmesg or system logs on affected kernels.

What your security team should do

• Prioritize kernel updates on TDX-enabled systems within standard change windows
• Review DMA-using drivers and TDX configurations for exposure
• Monitor upstream stable kernel releases for backports of the fix