CVE-2024-35939 in Linux
Summary
by MITRE • 05/19/2024
In the Linux kernel, the following vulnerability has been resolved:
dma-direct: Leak pages on dma_set_decrypted() failure
On TDX it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues.
DMA could free decrypted/shared pages if dma_set_decrypted() fails. This should be a rare case. Just leak the pages in this case instead of freeing them.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability described in CVE-2024-35939 resides within the Linux kernel's dma-direct subsystem, specifically addressing a memory management issue that occurs during decryption operations on trusted domain extensions (TDX) environments. This flaw represents a critical security concern that could potentially lead to memory leaks and security breaches in virtualized environments where memory encryption is actively utilized. The vulnerability manifests when the set_memory_encrypted() or set_memory_decrypted() functions fail during TDX operations, resulting in memory that becomes shared between trusted and untrusted domains. According to CWE-459, this represents a partial cleanup vulnerability where resources are not properly released, creating a potential attack surface for malicious actors seeking to exploit memory management inconsistencies.
The technical flaw occurs within the dma_set_decrypted() function implementation where error handling is insufficient to properly manage cases where memory decryption operations fail. When such failures occur in TDX environments, the system attempts to free decrypted or shared pages, which creates a scenario where memory allocated to the page allocator could contain sensitive data that should remain encrypted. This mismanagement of memory allocation directly impacts the kernel's memory management subsystem and could potentially allow for information disclosure or privilege escalation attacks. The vulnerability is particularly concerning because it operates at the kernel level where memory management decisions directly affect system security boundaries. The specific error handling mechanism fails to account for the possibility that memory pages may become shared due to host-level failures, creating a scenario where freed pages could be reallocated to untrusted contexts.
The operational impact of this vulnerability extends beyond simple memory leaks, potentially affecting system stability and security in virtualized environments. When TDX fails to properly decrypt memory pages, the system should ideally leak the pages rather than free them back to the allocator, but the current implementation fails to handle this correctly. This creates a potential for memory corruption or information leakage where sensitive data could be inadvertently exposed to untrusted processes or domains. The vulnerability affects systems using TDX technology where memory encryption is actively managed, particularly impacting cloud environments and virtualization platforms that rely on hardware-assisted memory encryption. From an ATT&CK perspective, this vulnerability maps to T1068 (Exploitation for Privilege Escalation) and T1552 (Unsecured Credentials) as it could enable attackers to gain access to memory contents that should remain encrypted, potentially leading to privilege escalation or data theft.
The mitigation strategy for this vulnerability involves implementing proper error handling in the dma-direct subsystem to ensure that when dma_set_decrypted() fails, the system leaks the pages rather than attempting to free them back to the page allocator. This approach prevents the potential for shared memory to be reallocated to untrusted contexts while maintaining system stability. System administrators should ensure their Linux kernel versions include the patched implementation that properly handles these error conditions, particularly in virtualized environments using TDX or similar technologies. The fix requires careful consideration of memory management implications and proper error state handling to prevent the scenario where decrypted pages could be reused in contexts where they should remain encrypted. Organizations using memory encryption features in virtualized environments should prioritize applying this patch to maintain security boundaries and prevent potential exploitation of this memory management flaw that could compromise system integrity.