CVE-2024-46794

What it actually does

mmio_read() in x86 TDX passes an uninitialized stack variable (val) as input to TDVMCALL, leaking its prior contents to the VMM instead of sending only the output buffer.

Why it matters to the business

Hypervisors or compromised VMMs can read residual kernel stack data, raising the risk of credential or secret exposure on systems using Intel TDX; the issue affects many Linux deployments but carries low exploitability.

How an attack unfolds

An attacker controlling the VMM observes the TDVMCALL parameters during an MMIO read from a guest; the original contents of the uninitialized val variable are sent instead of zeros or the pointer, allowing the VMM to capture whatever value previously occupied that stack location.

How to fix it

Update the Linux kernel to commit 26c6af49d26ffc377e392e30d4086db19eed0ef7 or later stable releases that initialize or avoid passing val to the VMM; apply vendor backports for the affected distribution kernels.

How to confirm the fix worked

Verify the running kernel contains commit 26c6af49d26ffc377e392e30d4086db19eed0ef7 via git log or package version; confirm mmio_read no longer passes uninitialized stack data in TDX paths through source review or kernel debugging.

Typical attack path

1. Gain control of or compromise the VMM hosting a TDX guest
2. Trigger MMIO reads from the guest kernel via device emulation or I/O operations
3. Inspect TDVMCALL registers or buffers to capture the leaked stack value
4. Correlate leaked data with other observations to extract sensitive information

How to detect it

Inspect kernel source or running binaries for the pre-fix mmio_read implementation; no runtime artifacts are produced on successful exploitation because the leak occurs inside a hypercall.

What your security team should do

• Prioritize patching TDX-enabled systems first due to direct VMM exposure
• Apply the fixed commit or latest stable kernel across all Linux distributions
• Review TDX guest configurations to limit unnecessary MMIO exposure
• Monitor upstream stable branches for additional related fixes