CVE-2024-35875 in Linux
Summary
by MITRE • 05/19/2024
In the Linux kernel, the following vulnerability has been resolved:
x86/coco: Require seeding RNG with RDRAND on CoCo systems
There are few uses of CoCo that don't rely on working cryptography and hence a working RNG. Unfortunately, the CoCo threat model means that the VM host cannot be trusted and may actively work against guests to extract secrets or manipulate computation. Since a malicious host can modify or observe nearly all inputs to guests, the only remaining source of entropy for CoCo guests is RDRAND.
If RDRAND is broken -- due to CPU hardware fault -- the RNG as a whole is meant to gracefully continue on gathering entropy from other sources, but since there aren't other sources on CoCo, this is catastrophic. This is mostly a concern at boot time when initially seeding the RNG, as after that the consequences of a broken RDRAND are much more theoretical.
So, try at boot to seed the RNG using 256 bits of RDRAND output. If this fails, panic(). This will also trigger if the system is booted without RDRAND, as RDRAND is essential for a safe CoCo boot.
Add this deliberately to be "just a CoCo x86 driver feature" and not part of the RNG itself. Many device drivers and platforms have some desire to contribute something to the RNG, and add_device_randomness() is specifically meant for this purpose.
Any driver can call it with seed data of any quality, or even garbage quality, and it can only possibly make the quality of the RNG better or have no effect, but can never make it worse.
Rather than trying to build something into the core of the RNG, consider the particular CoCo issue just a CoCo issue, and therefore separate it all out into driver (well, arch/platform) code.
[ bp: Massage commit message. ]
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability described in CVE-2024-35875 represents a critical security issue within the Linux kernel's handling of random number generation on Confidential Computing (CoCo) systems. This flaw specifically affects x86-based CoCo platforms where the kernel must ensure proper entropy seeding during boot processes to maintain cryptographic security guarantees. The vulnerability stems from the kernel's insufficient handling of random number generator initialization when running on trusted computing environments where the host system cannot be trusted. In CoCo deployments, the threat model explicitly assumes that the virtual machine host may actively attempt to extract secrets or manipulate guest computations, making the integrity of entropy sources paramount for system security.
The technical implementation of this vulnerability involves the kernel's random number generator initialization process on CoCo systems. The Linux kernel's approach to seeding the random number generator requires careful consideration of entropy sources, particularly when operating in environments where traditional entropy sources may be compromised or unavailable. The kernel must rely exclusively on RDRAND instructions for entropy generation on CoCo systems, as other entropy sources are either unavailable or potentially compromised by malicious hosts. This creates a single point of failure where the entire random number generation process becomes dependent on the integrity of the CPU's hardware random number generator, which represents a fundamental security assumption that must be validated during system boot.
The operational impact of this vulnerability is severe for CoCo environments, as it directly affects system boot processes and cryptographic security guarantees. When RDRAND fails due to CPU hardware faults or when systems are booted without RDRAND support, the kernel's current implementation would continue attempting to gather entropy from other sources, which do not exist in CoCo environments. This leads to catastrophic failure conditions where the system cannot properly initialize its random number generator, potentially compromising all cryptographic operations that depend on secure random values. The fix implemented requires the kernel to deliberately panic during boot if it cannot obtain 256 bits of entropy from RDRAND, ensuring that systems with broken or missing RDRAND support fail fast rather than continuing with potentially compromised security.
The solution architecture demonstrates proper separation of concerns by isolating the CoCo-specific RNG seeding logic into driver code rather than modifying the core random number generator implementation. This approach follows the principle of least privilege and system design best practices, ensuring that platform-specific security requirements do not inadvertently affect the general-purpose random number generation capabilities of the kernel. The implementation uses the add_device_randomness() function to incorporate entropy from device drivers, which is designed to be safe for any quality of input data and cannot degrade the overall quality of the random number generator. This approach aligns with the ATT&CK framework's concept of system hardening by ensuring that security-critical initialization processes are robust against hardware failures and maintain security guarantees even when operating under constrained environments.
This vulnerability classification aligns with CWE-330, which addresses insufficient entropy in cryptographic operations, and CWE-310, which covers cryptographic issues related to entropy sources. The fix represents a defensive programming approach that prioritizes system security over operational convenience by implementing fail-fast behavior for critical security components. The solution specifically addresses the unique threat model of Confidential Computing environments where traditional security assumptions do not apply, ensuring that systems running on CoCo platforms maintain cryptographic integrity through proper entropy management during boot processes. The kernel's approach to handling this vulnerability demonstrates a comprehensive understanding of the security implications of hardware-level random number generation and the critical importance of proper entropy seeding in trusted computing environments.