CVE-2023-4155

Published: 9 August 2023

A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the `VMGEXIT` handler recursively. If an attacker manages to call the handler multiple times, they can trigger a stack overflow and cause a denial of service or potentially guest-to-host escape in kernel configurations without stack guard pages (`CONFIG_VMAP_STACK`).

From the Ubuntu Security Team

Andy Nguyen discovered that the KVM implementation for AMD processors in the Linux kernel with Secure Encrypted Virtualization (SEV) contained a race condition when accessing the GHCB page. A local attacker in a SEV guest VM could possibly use this to cause a denial of service (host system crash).

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4155
• https://git.kernel.org/linus/7588dbcebcbf0193ab5b76987396d0254270b04a
• https://patchew.org/linux/20230804173355.51753-1-pbonzini@redhat.com/
• https://ubuntu.com/security/notices/USN-6343-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=2213802
• https://bugzilla.suse.com/show_bug.cgi?id=1214022