CVE-2024-46689

What it actually does

The cmd-db shared memory region is mapped as write-back (WB) instead of write-combine (WC), allowing cache eviction operations to be misinterpreted by the XPU as writes to a protected region, triggering secure interrupts and endless loops in TrustZone.

Why it matters to the business

Can cause system instability or denial of service on Qualcomm-based systems when using hypervisors other than the Qualcomm one, such as KVM or Xen. Low exploitation likelihood based on EPSS of 0.00253 with no trend change.

How an attack unfolds

An attacker with ability to influence hypervisor setup or memory mappings could trigger the condition on affected Qualcomm platforms, though the issue primarily manifests as a stability problem under non-Qualcomm hypervisors like Xen or KVM; referenced in broad 2024 zero-day campaigns by espionage and financially motivated actors but not confirmed as a primary vector.

How to fix it

Update the Linux kernel to the fixed commit 0ee9594c974368a17e85a431e9fe1c14fb65c278 (or equivalent stable release) that changes the cmd-db mapping from MEMREMAP_WB to MEMREMAP_WC.

How to confirm the fix worked

Inspect kernel source or runtime memory mapping attributes for cmd-db to confirm MEMREMAP_WC is in use; test boot under target hypervisor (Xen/KVM) and verify absence of TrustZone interrupt loops.

Typical attack path

1. Identify Qualcomm SoC system running vulnerable kernel
2. Deploy or force use of incompatible hypervisor (KVM/Xen)
3. Trigger cache eviction operations touching cmd-db region
4. Induce XPU false-positive write detection and TrustZone interrupt loop

How to detect it

Review kernel and hypervisor logs for repeated secure interrupts, TrustZone loops, or XPU violations on Qualcomm hardware; correlate with boot-time cmd-db mapping decisions.

What your security team should do

• Prioritize kernel update on all Qualcomm SoC deployments using non-Qualcomm hypervisors
• Validate the fix in staging environments with Xen or KVM
• Review hypervisor Stage-2 mappings for any remaining cmd-db dependencies
• Monitor EPSS and threat actor reports for changes in exploit maturity