CVE-2024-35791: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-35791 is a use-after-free vulnerability discovered in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem, specifically affecting the SVM (Secure Virtual Machine) component. The vulnerability was discovered in May 2024 and affects the svm_register_enc_region() function. The issue occurs when handling encrypted memory regions in virtualized environments (NVD).

The vulnerability stems from a race condition where region and/or its array of pages could be freed by a different task after dropping kvm->lock, particularly if userspace has __unregister_enc_region_locked() already queued up for the region. The issue involves cache flushing of converted pages in svm_register_enc_region() that needs to be performed before dropping kvm->lock to prevent use-after-free issues. While using local variables might seem like an obvious fix, it doesn't fully resolve the bug since region->pages is dynamically allocated (Kernel Commit).

The vulnerability could lead to use-after-free issues in the Linux kernel's KVM subsystem when handling encrypted memory regions. This could potentially affect system stability and security in virtualized environments, particularly on systems using AMD's SVM technology (NVD).

The vulnerability occurs on a rare slow path, and the manual flush is only needed on CPUs that lack coherency for encrypted memory. While this somewhat limits the exposure, the issue could be triggered when userspace operations interact with encrypted memory region management (Kernel Commit).

The issue has been fixed in the Linux kernel by modifying the svm_register_enc_region() function to perform cache flushing before dropping kvm->lock. The fix has been backported to various stable kernel versions. Users should update their kernel to a patched version. For Ubuntu 22.04 LTS, the fix is included in version 5.15.0-116.126, and for Red Hat Enterprise Linux, it's included in kernel-rt version 5.14.0-284.75.1.rt14.360 (Ubuntu, Red Hat).