CVE-2024-25744: Linux Kernel Privilege Escalation Flaw

CVE-2024-25744 Overview

CVE-2024-25744 affects the Linux kernel before version 6.6.7. The flaw allows an untrusted Virtual Machine Monitor (VMM) to trigger int80 syscall handling at any given point in a guest running on Intel Trust Domain Extensions (TDX). The issue resides in arch/x86/coco/tdx/tdx.c and arch/x86/mm/mem_encrypt_amd.c, which handle confidential computing primitives on x86. The vulnerability undermines the isolation guarantees that TDX is designed to enforce between the guest and a potentially malicious hypervisor. It is tracked under [CWE-693: Protection Mechanism Failure].

Critical Impact
An untrusted VMM can inject int80 syscall events into a TDX guest, breaking confidential computing isolation and impacting guest confidentiality, integrity, and availability.

Affected Products

Linux Kernel versions prior to 6.6.7
x86 systems using Intel TDX confidential computing (arch/x86/coco/tdx/tdx.c)
x86 systems using AMD memory encryption (arch/x86/mm/mem_encrypt_amd.c)

Discovery Timeline

2024-02-12 - CVE-2024-25744 published to NVD
2025-05-07 - Last updated in NVD database

Technical Details for CVE-2024-25744

Vulnerability Analysis

The vulnerability stems from improper handling of int80 software interrupts within the Linux kernel's TDX guest code path. Intel TDX is a confidential computing technology that isolates guest virtual machines from the host hypervisor. The kernel's TDX guest code must treat the VMM as untrusted and validate every event delivered from the host. Prior to 6.6.7, the kernel allowed the VMM to inject int80 syscall handling events at arbitrary execution points. This violates the trust boundary because syscall semantics should originate from guest user space, not from the host. The vulnerability is classified under [CWE-693] as a protection mechanism failure, since the TDX isolation guarantee can be bypassed by adversary-controlled event injection.

Root Cause

The root cause is missing validation in the TDX guest event handling logic in arch/x86/coco/tdx/tdx.c. The handler accepted int80 syscall delivery from the VMM without verifying that the event originated from legitimate guest execution context. Related changes in arch/x86/mm/mem_encrypt_amd.c address similar confidential computing event handling concerns.

Attack Vector

Exploitation requires a malicious or compromised VMM controlling the host. An attacker with hypervisor-level control can deliver crafted int80 events to a TDX guest at chosen execution points. This can redirect guest control flow into syscall handlers under attacker-influenced state, defeating the confidentiality and integrity guarantees of the trust domain. Local access from the hypervisor side is required, and no user interaction is needed inside the guest. See the upstream commit b82a8db for the precise code paths involved.

// No verified public exploit code is available for CVE-2024-25744.
// Refer to the upstream kernel commit b82a8db for the corrective changes
// in arch/x86/coco/tdx/tdx.c and arch/x86/mm/mem_encrypt_amd.c.

Detection Methods for CVE-2024-25744

Indicators of Compromise

Unexpected int80 syscall traces in TDX guest kernel logs that do not correspond to user-space activity.
Anomalous transitions between guest user mode and kernel mode logged via ftrace or perf on TDX-enabled systems.
TDX guests running kernel versions earlier than 6.6.7 on hardware exposed to untrusted hypervisors.

Detection Strategies

Inventory Linux kernel versions across confidential computing workloads and flag any host or guest running below 6.6.7.
Audit confidential computing deployments to confirm that TDX guests boot only on attested, trusted hypervisor stacks.
Correlate kernel build metadata against the fix commit b82a8db to verify the patch is present.

Monitoring Recommendations

Monitor kernel package updates on distribution feeds and apply the 6.6.7 stable release or distribution-backported equivalent.
Enable kernel audit logging for unusual syscall entry patterns inside TDX guests.
Track vendor advisories such as the NetApp Security Advisory NTAP-20241115-0006 for downstream product impact.

How to Mitigate CVE-2024-25744

Immediate Actions Required

Upgrade affected systems to Linux kernel 6.6.7 or later, or apply the distribution-provided backport containing commit b82a8db.
Restrict TDX guest deployment to attested hypervisors and trusted cloud providers until patches are applied.
Review all confidential computing workloads on x86 hardware for exposure to untrusted VMMs.

Patch Information

The vulnerability is fixed in Linux kernel 6.6.7 via the upstream change documented in the Linux Kernel ChangeLog 6.6.7 and the Linux Kernel Commit b82a8db. The fix hardens the TDX guest entry path to reject int80 events injected from an untrusted VMM. Downstream vendor guidance is available in the NetApp Security Advisory NTAP-20241115-0006.

Workarounds

No official workaround exists outside of patching; rebuild or update the kernel to 6.6.7 or later.
Where patching is delayed, avoid running TDX guests on hypervisors that cannot be cryptographically attested.
Limit local hypervisor privileges and segment management planes to reduce the chance of a hostile VMM operating against guest workloads.

bash

# Verify the running kernel version is patched
uname -r

# On Debian/Ubuntu - update kernel package
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-generic

# On RHEL/Rocky/AlmaLinux - update kernel package
sudo dnf update kernel

# Reboot to activate the patched kernel
sudo reboot