CVE-2024-35994

What it actually does

Improper separate kzalloc allocations for request and response buffers in qcom uefisecapp cause the QSEECOM APP_SEND command to violate firmware expectations for a single contiguous memory region, resulting in missing responses, EINVAL from TZ, EIO propagation, or device hard-reset.

Why it matters to the business

Sporadic but deterministic crashes or resets on Qualcomm-based Linux systems disrupt availability and can lead to data loss or operational downtime in embedded and server environments.

How an attack unfolds

An attacker or faulty driver code issues qcom_scm_qseecom_app_send calls that allocate request and response buffers separately; under low memory contention these regions are often adjacent and the bug is masked, but when they are not the firmware rejects the layout or writes nothing, triggering kernel errors or resets.

How to fix it

Upgrade the Linux kernel to the commit dd22b34fb53cb04b13b2f5eee5c9200bb091fc88 or later stable releases that contain the single-region allocation fix and the restructured qcom_scm_qseecom_app_send interface.

How to confirm the fix worked

Confirm the running kernel contains commit dd22b34fb53cb04b13b2f5eee5c9200bb091fc88; exercise the uefisecapp code paths and verify absence of EIO/EINVAL returns and hard resets under varied memory pressure.

Typical attack path

1. Identify a process or driver path that invokes qcom_scm_qseecom_app_send
2. Trigger the call under memory conditions that separate the two kzalloc regions
3. Observe EIO, EINVAL, or hard-reset as the firmware fails to handle the split buffers

How to detect it

Search kernel logs and dmesg for repeated EIO or EINVAL returns from qcom_scm_qseecom_app_send or qseecom paths, and correlate with unexpected device resets or watchdog events.

• qcom_scm_qseecom_app_send
• uefisecapp
• APP_SEND.*EINVAL
• APP_SEND.*EIO

What your security team should do

• Apply the fixed kernel commit immediately on all affected Qualcomm platforms
• Monitor kernel logs for EIO and EINVAL from SCM calls as indicators of exposure
• Test the updated kernel under representative workloads before broad deployment