CVE-2024-49858: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
In the Linux kernel, the following vulnerability has been resolved:
efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
The TPM event log table is a Linux specific construct, where the data produced by the GetEventLog() boot service is cached in memory, and passed on to the OS using an EFI configuration table.
The use of EFILOADERDATA here results in the region being left unreserved in the E820 memory map constructed by the EFI stub, and this is the memory description that is passed on to the incoming kernel by kexec, which is therefore unaware that the region should be reserved.
Even though the utility of the TPM2 event log after a kexec is questionable, any corruption might send the parsing code off into the weeds and crash the kernel. So let's use EFIACPIRECLAIMMEMORY instead, which is always treated as reserved by the E820 conversion logic.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
Use EFI_ACPI_RECLAIM_MEMORY instead of EFI_LOADER_DATA for the TPM event log so the region is treated as reserved in the E820 memory map.
Linux kernel EFI stub TPM event log EFI memory type for the TPM event log = EFI_ACPI_RECLAIM_MEMORY
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49858?
CVE-2024-49858 is classified as a moderate severity vulnerability in the Linux kernel.
How does CVE-2024-49858 affect the Linux kernel?
CVE-2024-49858 affects the TPM event log handling, risking event log corruption if not addressed.
How do I fix CVE-2024-49858?
To fix CVE-2024-49858, upgrade to Linux kernel versions 6.1.123-1, 6.12.12-1, or later versions that contain the patch.
Which Linux kernel versions are vulnerable to CVE-2024-49858?
Linux kernel versions before 5.10.227, between 5.11 and 5.15.168, and other specified ranges leading up to 6.11.2 are vulnerable to CVE-2024-49858.
What are the potential risks of not addressing CVE-2024-49858?
Not addressing CVE-2024-49858 can lead to corruption of the TPM event logs, which may affect system integrity and security.