CVE-2024-35994 is a vulnerability identified in the Linux kernel's Qualcomm Secure Execution Environment Communication (QSEECOM) application interface, specifically within the uefisecapp firmware component. The vulnerability arises from improper handling of memory buffers used for request and response data in the QSEECOM APP_SEND command. Although the command protocol defines separate fields for request and response buffers, the uefisecapp implementation incorrectly expects both buffers to reside within a single contiguous memory region. When this expectation is not met, it can lead to multiple failure modes including the absence of response data (triggering an I/O error), the Secure Channel Manager (SCM) call failing with an invalid argument error (EINVAL) directly from the TrustZone firmware, or even causing the device to undergo a hard reset. The issue is sporadic due to the typical allocation pattern where two consecutive kzalloc() calls often return adjacent memory regions, masking the problem under normal conditions. The fix involves allocating a single contiguous memory region for both request and response buffers with proper alignment, and restructuring the qcom_scm_qseecom_app_send() interface to shift DMA allocation responsibility to the caller, thereby preventing separate DMA mappings that could cause the issue. This vulnerability affects Linux kernel versions identified by the commit hash 759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9 and was publicly disclosed on May 20, 2024. No known exploits are currently reported in the wild.

For European organizations, the impact of CVE-2024-35994 primarily concerns devices and systems running Linux kernels with Qualcomm TrustZone firmware components, particularly those using the QSEECOM interface for secure communication. The vulnerability can cause sporadic device crashes or hard resets, leading to potential denial of service conditions. In critical infrastructure or embedded systems relying on Qualcomm-based secure environments, such instability could disrupt operations, degrade service availability, or cause system downtime. While the vulnerability does not directly indicate data leakage or privilege escalation, the loss of availability and potential for unexpected resets could impact operational continuity, especially in sectors like telecommunications, automotive, industrial control systems, and IoT deployments prevalent in Europe. The sporadic nature of the fault may complicate troubleshooting and incident response, increasing operational risk. Since the issue stems from firmware interaction, remediation may require coordinated kernel and firmware updates, which can be challenging in environments with strict change control or legacy hardware. However, no evidence currently suggests active exploitation or direct compromise of confidentiality or integrity.

European organizations should prioritize updating their Linux kernels to versions that include the patch for CVE-2024-35994 as soon as it becomes available. Given the vulnerability involves low-level firmware communication, organizations should: 1) Identify all systems using Qualcomm TrustZone firmware and the affected Linux kernel versions, focusing on embedded devices, mobile infrastructure, and IoT devices. 2) Coordinate with hardware and firmware vendors to obtain and deploy firmware updates that complement the kernel patch, ensuring the QSEECOM interface is correctly handled. 3) Implement monitoring for unusual device resets, I/O errors, or SCM call failures that could indicate attempts to trigger this vulnerability or related instability. 4) For critical systems where immediate patching is not feasible, consider isolating affected devices from critical networks or applying compensating controls such as redundant systems to maintain availability. 5) Engage in thorough testing of updated kernels and firmware in staging environments to verify stability and compatibility, given the low-level nature of the fix and potential impact on DMA operations. 6) Maintain close collaboration with Linux kernel security mailing lists and Qualcomm security advisories for any emerging exploit information or additional patches.