CVE-2024-49851

What it actually does

The vulnerability occurs because tpm_dev_transmit prepares TPM space before transmitting a command but performs no rollback or flush of that preparation when the command fails, allowing transient handles to leak when the device is subsequently closed without additional commands.

Why it matters to the business

Systems using TPM devices may experience gradual resource exhaustion or reduced TPM availability, increasing operational overhead for security-critical operations until the kernel is updated, especially on high-prevalence Linux deployments.

How an attack unfolds

A local attacker interacts with the TPM device, issues a command that triggers a transmission failure, then closes the device without further commands, leaving transient handles leaked; this pattern has been referenced in broad 2024 exploitation campaigns targeting Linux kernel resource issues by espionage and financially motivated actors.

How to fix it

Update the Linux kernel to a version containing the fix that flushes TPM space on command transmission failure; apply the patch referenced in the resolution for CVE-2024-49851.

How to confirm the fix worked

Inspect the error handling path in tpm_dev_transmit to confirm the flush call is present, then test by forcing command failures and verifying that transient handle counts return to baseline after device closure.

Typical attack path

1. Obtain local user access on a Linux system with TPM support
2. Open the TPM device node and prepare a command that will fail during transmission
3. Trigger the failure path in tpm_dev_transmit without subsequent cleanup commands
4. Close the device handle to leave transient handles leaked
5. Repeat to accumulate leaks and degrade TPM functionality

How to detect it

Examine kernel logs and TPM driver traces for sequences of command transmission failures immediately followed by device close operations without intervening successful commands; correlate with handle allocation patterns in TPM-related audit events.

What your security team should do

• Apply kernel updates immediately on systems exposing TPM devices given the 721 days since publication and ongoing Linux kernel exploitation activity
• Restrict local access to TPM device nodes via permissions or SELinux policies
• Monitor EPSS and threat actor reports for any increase in targeting of this class of resource-leak issues