CVE-2024-49858: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
In the Linux kernel, the following vulnerability has been resolved:
efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
The TPM event log table is a Linux specific construct, where the data produced by the GetEventLog() boot service is cached in memory, and passed on to the OS using an EFI configuration table.
The use of EFILOADERDATA here results in the region being left unreserved in the E820 memory map constructed by the EFI stub, and this is the memory description that is passed on to the incoming kernel by kexec, which is therefore unaware that the region should be reserved.
Even though the utility of the TPM2 event log after a kexec is questionable, any corruption might send the parsing code off into the weeds and crash the kernel. So let's use EFIACPIRECLAIMMEMORY instead, which is always treated as reserved by the E820 conversion logic.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49858?
CVE-2024-49858 is classified as a moderate severity vulnerability in the Linux kernel.
How does CVE-2024-49858 affect the Linux kernel?
CVE-2024-49858 affects the TPM event log handling, risking event log corruption if not addressed.
How do I fix CVE-2024-49858?
To fix CVE-2024-49858, upgrade to Linux kernel versions 6.1.123-1, 6.12.12-1, or later versions that contain the patch.
Which Linux kernel versions are vulnerable to CVE-2024-49858?
Linux kernel versions before 5.10.227, between 5.11 and 5.15.168, and other specified ranges leading up to 6.11.2 are vulnerable to CVE-2024-49858.
What are the potential risks of not addressing CVE-2024-49858?
Not addressing CVE-2024-49858 can lead to corruption of the TPM event logs, which may affect system integrity and security.