CVE-2024-35939: Linux Kernel Information Disclosure Flaw

CVE-2024-35939 Overview

CVE-2024-35939 affects the Linux kernel's dma-direct subsystem when running on Intel Trust Domain Extensions (TDX) platforms. An untrusted host can cause set_memory_encrypted() or set_memory_decrypted() operations to fail, leaving memory in a shared state. If dma_set_decrypted() fails, the previous implementation could free decrypted or shared pages back to the page allocator. This behavior risks returning shared memory to general allocation pools, creating potential functional and security integrity problems in confidential computing environments.

Critical Impact
A local attacker on a TDX guest can trigger conditions where decrypted (shared) memory is returned to the page allocator, undermining confidential computing memory isolation guarantees.

Affected Products

Linux Kernel (multiple stable branches prior to the fix commits)
Systems running on Intel TDX confidential computing platforms
Distributions shipping affected kernel versions using dma-direct allocation paths

Discovery Timeline

2024-05-19 - CVE-2024-35939 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35939

Vulnerability Analysis

The vulnerability resides in the Linux kernel's direct DMA allocation path (dma-direct). On Intel TDX guests, memory can be transitioned between encrypted (private) and decrypted (shared) states via set_memory_encrypted() and set_memory_decrypted(). The untrusted host has influence over these state transitions and can induce failures. When dma_set_decrypted() failed during DMA allocation cleanup, the kernel previously freed pages that remained in a decrypted or shared state. Returning such pages to the page allocator violates the memory confidentiality model that TDX enforces. The patched behavior leaks the pages instead of freeing them, sacrificing a small amount of memory to preserve isolation guarantees. This category falls under kernel memory management and confidential computing integrity [CWE-noinfo].

Root Cause

The root cause is missing error handling in the DMA-direct allocator. When dma_set_decrypted() returned an error, the kernel proceeded to free pages that were left in a shared state, allowing them to re-enter the general allocator pool.

Attack Vector

Exploitation requires local access on a TDX guest. An untrusted host or hypervisor-level adversary manipulates memory state transitions to force dma_set_decrypted() failures, triggering the flawed free path inside the guest kernel and enabling reuse of shared memory as private memory.

No public proof-of-concept code is available for this vulnerability. Technical details of the fix are documented in the upstream stable kernel commits 4031b72c, 4e0cfb25, b57326c9, and b9fa1694. See Kernel Git Commit Fix for the reference implementation.

Detection Methods for CVE-2024-35939

Indicators of Compromise

Kernel log entries reporting set_memory_decrypted() or set_memory_encrypted() failures on TDX guests
Unexpected DMA allocation failures accompanied by page state transition errors
Anomalous memory pressure patterns on confidential computing workloads without corresponding workload changes

Detection Strategies

Audit installed kernel versions across TDX-enabled hosts against the fixed commits listed in the vendor advisories
Monitor kernel ring buffer (dmesg) for dma-direct warnings and memory encryption state failures
Track guest-side kernel telemetry for repeated failures in DMA allocation paths that could indicate host-driven manipulation

Monitoring Recommendations

Centralize kernel logs from confidential computing workloads to a SIEM for correlation of memory state failures
Alert on kernel version drift where TDX guests remain on pre-patch stable branches
Baseline DMA allocation error rates and flag statistical anomalies across TDX fleets

How to Mitigate CVE-2024-35939

Immediate Actions Required

Update the Linux kernel to a stable release containing commits 4031b72c, 4e0cfb25, b57326c9, or b9fa1694
Prioritize patching on any hosts operating as TDX guests or intended for confidential computing deployments
Verify distribution vendor advisories to confirm the fix has been backported to the running kernel branch

Patch Information

The fix modifies the dma-direct allocator to leak pages when dma_set_decrypted() fails, preventing shared memory from being returned to the page allocator. Refer to the upstream commits: Kernel Git Commit Update, Kernel Git Commit Fix, Kernel Git Commit Change, and Kernel Git Commit Modification.

Workarounds

No supported workaround exists; kernel patching is the required remediation
Where patching is delayed, restrict local user access on TDX guests and reduce reliance on untrusted host environments
Monitor DMA allocation failure telemetry to identify potentially affected workloads until patches are deployed

bash

# Verify running kernel version and confirm patch presence
uname -r
grep -i "dma-direct" /var/log/kern.log
# On distributions using DNF/APT, apply the latest kernel update
sudo apt update && sudo apt upgrade linux-image-$(uname -r)
# or
sudo dnf update kernel