CVE-2024-35939 is a vulnerability identified in the Linux kernel related to the Direct Memory Access (DMA) subsystem, specifically within the dma-direct component. The issue arises from improper handling of failures in the functions set_memory_encrypted() and set_memory_decrypted() when running on Intel's Trust Domain Extensions (TDX) technology. TDX is designed to provide hardware-based memory encryption and isolation for virtual machines, enhancing security in cloud and multi-tenant environments. The vulnerability occurs when the untrusted host causes these memory encryption or decryption functions to fail, resulting in an error return but leaving the affected memory pages shared and decrypted. The Linux kernel callers of these functions must properly handle such errors to avoid returning decrypted and shared memory pages back to the page allocator. Failure to do so can lead to functional anomalies or security issues. Specifically, the dma_set_decrypted() function may fail and inadvertently free decrypted/shared pages, which is a rare condition. The kernel's current mitigation is to leak these pages rather than free them, preventing potential reuse of sensitive memory. However, leaking memory pages can still pose risks such as resource exhaustion or information disclosure under certain conditions. This vulnerability highlights the complexity of securely managing memory encryption states in environments leveraging hardware-based memory protection like TDX. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet. The affected versions correspond to specific Linux kernel commits prior to the patch addressing this issue.

For European organizations, especially those operating cloud infrastructure or virtualized environments using Linux kernels with TDX support, this vulnerability could have significant implications. If exploited, it could lead to unintended exposure of decrypted memory pages, potentially allowing attackers with control over the untrusted host to access sensitive information or cause instability in memory management. This could compromise confidentiality and integrity of data processed within virtual machines, undermining trust in hardware-based isolation mechanisms. Additionally, leaking memory pages could result in resource exhaustion, affecting availability of services. Organizations relying on Linux-based servers, particularly those using Intel TDX for secure virtualization, may face increased risk of data leakage or denial of service if this vulnerability is exploited. Given the increasing adoption of confidential computing technologies in Europe, the impact could extend to sectors such as finance, healthcare, and government, where data protection is critical.

European organizations should prioritize updating their Linux kernel versions to include the patch that addresses CVE-2024-35939 as soon as it becomes available. Until patched, administrators should audit their use of TDX-enabled environments and assess the risk of untrusted host interference. Specific mitigations include: 1) Implement strict host isolation and monitoring to detect anomalous behavior that could trigger memory encryption/decryption failures. 2) Limit access to host-level controls and ensure only trusted administrators can manage virtualization hosts. 3) Employ runtime integrity checks and memory protection mechanisms to detect and prevent unauthorized memory sharing. 4) Monitor system logs for errors related to dma_set_decrypted() or memory encryption failures to identify potential exploitation attempts. 5) Engage with Linux distribution vendors to obtain timely patches and verify kernel versions in use. 6) Consider deploying additional layers of encryption and data protection within virtual machines to reduce impact if decrypted memory pages are leaked. These steps go beyond generic advice by focusing on the specific failure modes and operational context of TDX and DMA memory management.