CVE-2024-49858

What it actually does

The TPM event log table uses EFI_LOADER_DATA memory which is not reserved in the E820 map passed to kexec, allowing the region to be overwritten and causing the kernel's event log parsing code to read corrupted data and crash.

Why it matters to the business

Systems performing kexec on TPM-enabled platforms risk kernel crashes and unexpected reboots, increasing downtime in environments that rely on fast reboot or live kernel replacement. No ransomware usage or CISA deadline applies.

How an attack unfolds

An attacker with local access or the ability to trigger kexec on a vulnerable Linux kernel causes the EFI stub to mark the TPM event log as ordinary loader data; after kexec the new kernel treats the region as free, corrupts it, and crashes when the TPM2 event log parser dereferences invalid structures. Listed threat actors have conducted Linux kernel exploitation campaigns but specific attribution to this issue is not confirmed.

How to fix it

Apply the upstream fix that changes the allocation to EFI_ACPI_RECLAIM_MEMORY. For the listed package use activerecord versions 6.0.3.5, 5.2.4.5, or 6.1.2.1 as appropriate for the deployment.

How to confirm the fix worked

Verify the EFI stub source uses EFI_ACPI_RECLAIM_MEMORY for the event log table and confirm the region appears reserved in the E820 map passed to kexec; test kexec on TPM-enabled hardware.

Typical attack path

1. Obtain local execution or kexec trigger capability on target
2. Invoke kexec while TPM event log is present
3. Trigger memory reuse of the unreserved EFI_LOADER_DATA region
4. Cause event-log parser to consume corrupted data
5. Crash the kernel

How to detect it

Inspect kernel logs for oops or panic messages containing tpm or event log references around kexec operations; examine EFI memory map dumps for absence of the expected reserved region.

What your security team should do

• Prioritize patching Linux kernels that support kexec on TPM platforms
• Monitor for kernel oops or panic strings referencing TPM event log parsing
• Disable kexec if the workload does not require it until patches are deployed