CVE-2024-25742
published 2024-05-17CVE-2024-25742: In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its handler. This affects…
PriorityP429medium6.5CVSS 3.1
AVLACHPRLUINSUCHIHAL
EPSS
0.18%
7.6th percentile
In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its handler. This affects AMD SEV-SNP and AMD SEV-ES.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.9.7-1 (forky) | linux 6.9.7-1 (forky) |
| linux | linux_kernel | >= 0 < 6.9.7-1 | 6.9.7-1 |
| linux | linux_kernel | >= 0 < 6.9.7-1 | 6.9.7-1 |
| linux | linux_kernel | >= 0 < 5.15.0-117.127 | 5.15.0-117.127 |
| linux | linux_kernel | >= 0 < 6.8.0-39.39 | 6.8.0-39.39 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-09-18·CVSS 6.3
CVE-2024-35825 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not
properly handle certain error conditions, leading to a NULL pointer
dereference. A local attacker could possibly trigger this vulnerability to
cause a denial of service. (CVE-2022-38096)
Gui-Dong Han discovered that the software RAID driver in the Linux kernel
contained a race condition, leading to an integer overflow vulnerability. A
privileged attacker could possibly use this to cause a denial of service
(system crash). (CVE-2024-23307)
Chenyuan Yang discovered that the CEC driver driver in the Linux kernel
contained a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (s
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2024-08-13·CVSS 5.5
CVE-2024-36952 [MEDIUM] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde
discovered that an untrusted hypervisor could inject malicious #VC
interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw
is known as WeSee. A local attacker in control of the hypervisor could use
this to expose sensitive information or possibly execute arbitrary code in
the trusted execution environment. (CVE-2024-25742)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- Block layer subsystem;
- Bluetooth drivers;
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2024-08-12·CVSS 5.5
CVE-2024-36905 [MEDIUM] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde
discovered that an untrusted hypervisor could inject malicious #VC
interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw
is known as WeSee. A local attacker in control of the hypervisor could use
this to expose sensitive information or possibly execute arbitrary code in
the trusted execution environment. (CVE-2024-25742)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- Block layer subsystem;
- Bluetooth drivers;
-
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-08-09·CVSS 6.5
CVE-2024-36029 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde
discovered that an untrusted hypervisor could inject malicious #VC
interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw
is known as WeSee. A local attacker in control of the hypervisor could use
this to expose sensitive information or possibly execute arbitrary code in
the trusted execution environment. (CVE-2024-25742)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- M68K architecture;
- OpenRISC architecture;
- PowerPC
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-07-30·CVSS 6.3
CVE-2024-35785 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not
properly handle certain error conditions, leading to a NULL pointer
dereference. A local attacker could possibly trigger this vulnerability to
cause a denial of service. (CVE-2022-38096)
Gui-Dong Han discovered that the software RAID driver in the Linux kernel
contained a race condition, leading to an integer overflow vulnerability. A
privileged attacker could possibly use this to cause a denial of service
(system crash). (CVE-2024-23307)
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacke
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-07-30·CVSS 7.8
CVE-2024-27017 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde
discovered that an untrusted hypervisor could inject malicious #VC
interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw
is known as WeSee. A local attacker in control of the hypervisor could use
this to expose sensitive information or possibly execute arbitrary code in
the trusted execution environment. (CVE-2024-25742)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- TTY drivers;
- SMB network file system;
- Netfilter;
- Bluetooth subsystem;
(CVE-2024-26886, CVE-
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-07-30·CVSS 6.5
CVE-2024-35992 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde
discovered that an untrusted hypervisor could inject malicious #VC
interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw
is known as WeSee. A local attacker in control of the hypervisor could use
this to expose sensitive information or possibly execute arbitrary code in
the trusted execution environment. (CVE-2024-25742)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- DMA engine subsystem;
- HID subsystem;
- I2C subsystem;
- PHY drivers;
- TTY drivers;
- IPv4 netw
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-07-29·CVSS 7.8
CVE-2024-27017 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde
discovered that an untrusted hypervisor could inject malicious #VC
interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw
is known as WeSee. A local attacker in control of the hypervisor could use
this to expose sensitive information or possibly execute arbitrary code in
the trusted execution environment. (CVE-2024-25742)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- TTY drivers;
- SMB network file system;
- Netfilter;
- Bluetooth subsystem;
(CVE-2024-26886, CVE-
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-07-29·CVSS 6.5
CVE-2024-35992 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde
discovered that an untrusted hypervisor could inject malicious #VC
interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw
is known as WeSee. A local attacker in control of the hypervisor could use
this to expose sensitive information or possibly execute arbitrary code in
the trusted execution environment. (CVE-2024-25742)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- DMA engine subsystem;
- HID subsystem;
- I2C subsystem;
- PHY drivers;
- TTY drivers;
- IPv4 netw
Red Hat
hw: amd: Instruction raise #VC exception at exit
vendor_redhat·2024-04-05·CVSS 6.5
CVE-2024-25742 [MEDIUM] hw: amd: Instruction raise #VC exception at exit
hw: amd: Instruction raise #VC exception at exit
In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its handler. This affects AMD SEV-SNP and AMD SEV-ES.
A vulnerability was found in AMD SEV-SNP, where a malicious hypervisor can potentially break confidentiality and integrity of SEV-SNP on Linux guests by injecting interrupts. An attacker can inject interrupt 0x80, which is used by Linux for legacy 32-bit system calls, and arbitrarily change the value stored in EAX while a SEV VM is running.
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterp
Debian
CVE-2024-25742: linux - In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual inter...
vendor_debian·2024·CVSS 6.5
CVE-2024-25742 [MEDIUM] CVE-2024-25742: linux - In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual inter...
In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its handler. This affects AMD SEV-SNP and AMD SEV-ES.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 6.9.7-1)
sid: resolved (fixed in 6.9.7-1)
trixie: resolved (fixed in 6.9.7-1)
OSV
linux-xilinx-zynqmp vulnerabilities
osv·2024-09-18·CVSS 5.5
CVE-2022-38096 [MEDIUM] linux-xilinx-zynqmp vulnerabilities
linux-xilinx-zynqmp vulnerabilities
Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not
properly handle certain error conditions, leading to a NULL pointer
dereference. A local attacker could possibly trigger this vulnerability to
cause a denial of service. (CVE-2022-38096)
Gui-Dong Han discovered that the software RAID driver in the Linux kernel
contained a race condition, leading to an integer overflow vulnerability. A
privileged attacker could possibly use this to cause a denial of service
(system crash). (CVE-2024-23307)
Chenyuan Yang discovered that the CEC driver driver in the Linux kernel
contained a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2024-23848)
OSV
linux-oracle-5.15 vulnerabilities
osv·2024-08-13·CVSS 5.5
CVE-2024-25742 [MEDIUM] linux-oracle-5.15 vulnerabilities
linux-oracle-5.15 vulnerabilities
Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde
discovered that an untrusted hypervisor could inject malicious #VC
interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw
is known as WeSee. A local attacker in control of the hypervisor could use
this to expose sensitive information or possibly execute arbitrary code in
the trusted execution environment. (CVE-2024-25742)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- Block layer subsystem;
- Bluetooth drivers;
- Clock framework and drivers;
- FireWire subsystem;
- GPU drivers;
- InfiniB
OSV
linux-azure vulnerabilities
osv·2024-08-13·CVSS 6.5
CVE-2024-25742 [MEDIUM] linux-azure vulnerabilities
linux-azure vulnerabilities
Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde
discovered that an untrusted hypervisor could inject malicious #VC
interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw
is known as WeSee. A local attacker in control of the hypervisor could use
this to expose sensitive information or possibly execute arbitrary code in
the trusted execution environment. (CVE-2024-25742)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- M68K architecture;
- OpenRISC architecture;
- PowerPC architecture;
- RISC-V architecture;
- x86 architecture;
- Block layer su
OSV
linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15 vulnerabilities
osv·2024-08-12·CVSS 5.5
CVE-2024-2574 [MEDIUM] linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15 vulnerabilities
linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15 vulnerabilities
Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde
discovered that an untrusted hypervisor could inject malicious #VC
interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw
is known as WeSee. A local attacker in control of the hypervisor could use
this to expose sensitive information or possibly execute arbitrary code in
the trusted execution environment. (CVE-2024-25742)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- Block layer subsystem;
- Bluetooth drivers;
- Clock framework and driv
OSV
linux-nvidia-lowlatency, linux-oracle vulnerabilities
osv·2024-08-09·CVSS 6.5
CVE-2024-25742 [MEDIUM] linux-nvidia-lowlatency, linux-oracle vulnerabilities
linux-nvidia-lowlatency, linux-oracle vulnerabilities
Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde
discovered that an untrusted hypervisor could inject malicious #VC
interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw
is known as WeSee. A local attacker in control of the hypervisor could use
this to expose sensitive information or possibly execute arbitrary code in
the trusted execution environment. (CVE-2024-25742)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- M68K architecture;
- OpenRISC architecture;
- PowerPC architecture;
- RISC-V architecture;
- x86 arch
OSV
linux-lowlatency vulnerabilities
osv·2024-07-30·CVSS 6.5
CVE-2024-25742 [MEDIUM] linux-lowlatency vulnerabilities
linux-lowlatency vulnerabilities
Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde
discovered that an untrusted hypervisor could inject malicious #VC
interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw
is known as WeSee. A local attacker in control of the hypervisor could use
this to expose sensitive information or possibly execute arbitrary code in
the trusted execution environment. (CVE-2024-25742)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- DMA engine subsystem;
- HID subsystem;
- I2C subsystem;
- PHY drivers;
- TTY drivers;
- IPv4 networking;
(CVE-2024-35997, CVE-2024-36016, CVE-2024-35990, CVE-2024-359
OSV
linux-gcp-5.15 vulnerabilities
osv·2024-07-30·CVSS 5.5
CVE-2022-38096 [MEDIUM] linux-gcp-5.15 vulnerabilities
linux-gcp-5.15 vulnerabilities
Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not
properly handle certain error conditions, leading to a NULL pointer
dereference. A local attacker could possibly trigger this vulnerability to
cause a denial of service. (CVE-2022-38096)
Gui-Dong Han discovered that the software RAID driver in the Linux kernel
contained a race condition, leading to an integer overflow vulnerability. A
privileged attacker could possibly use this to cause a denial of service
(system crash). (CVE-2024-23307)
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
(CVE-2024-24857, CVE-202
OSV
linux-aws-5.15, linux-ibm, linux-ibm-5.15, linux-raspi vulnerabilities
osv·2024-07-30·CVSS 7.8
CVE-2024-25742 [HIGH] linux-aws-5.15, linux-ibm, linux-ibm-5.15, linux-raspi vulnerabilities
linux-aws-5.15, linux-ibm, linux-ibm-5.15, linux-raspi vulnerabilities
Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde
discovered that an untrusted hypervisor could inject malicious #VC
interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw
is known as WeSee. A local attacker in control of the hypervisor could use
this to expose sensitive information or possibly execute arbitrary code in
the trusted execution environment. (CVE-2024-25742)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- TTY drivers;
- SMB network file system;
- Netfilter;
- Bluetooth subsystem;
(CVE-2024-26886, CVE-2023-52752, CVE-2024-36016, CVE
OSV
linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-nvidia, linux-oem-6.8, linux-raspi vulnerabilities
osv·2024-07-29·CVSS 6.5
[MEDIUM] linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-nvidia, linux-oem-6.8, linux-raspi vulnerabilities
linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-nvidia, linux-oem-6.8, linux-raspi vulnerabilities
Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde
discovered that an untrusted hypervisor could inject malicious #VC
interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw
is known as WeSee. A local attacker in control of the hypervisor could use
this to expose sensitive information or possibly execute arbitrary code in
the trusted execution environment. (CVE-2024-25742)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- DMA engine subsystem;
- HID subsystem;
- I2C subsystem;
- PHY drivers;
- TTY drivers;
- IPv
OSV
linux, linux-aws, linux-gcp, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, li
osv·2024-07-29·CVSS 7.8
[HIGH] linux, linux-aws, linux-gcp, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, li
linux, linux-aws, linux-gcp, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle vulnerabilities
Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde
discovered that an untrusted hypervisor could inject malicious #VC
interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw
is known as WeSee. A local attacker in control of the hypervisor could use
this to expose sensitive information or possibly execute arbitrary code in
the trusted execution environment. (CVE-2024-25742)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in
OSV
CVE-2024-25742: In the Linux kernel before 6
osv·2024-05-17·CVSS 6.5
CVE-2024-25742 [MEDIUM] CVE-2024-25742: In the Linux kernel before 6
In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its handler. This affects AMD SEV-SNP and AMD SEV-ES.
No detection rules found.
No public exploits indexed.
arXiv
Attestable Builds: Compiling Verifiable Binaries on Untrusted Systems using Trusted Execution Environments
arxiv_fulltext·2025-10-24
Attestable Builds: Compiling Verifiable Binaries on Untrusted Systems using Trusted Execution Environments
Attestable Builds: Compiling Verifiable Binaries on Untrusted Systems using Trusted Execution Environments
Daniel Hugenroth
These authors contributed equally to this work.
[email protected]
0000-0003-3413-1722
University of Cambridge
Cambridge
United Kingdom
Mario Lins
[1]
[email protected]
0000-0003-1713-3347
Johannes Kepler University Linz
Linz
Austria
René Mayrhofer
[email protected]
0000-0003-1566-4646
Johannes Kepler University Linz
Linz
Austria
Alastair R. Beresford
[email protected]
0000-0003-0818-6535
University of Cambridge
Cambridge
United Kingdom
CCSXML
10002978.10003022.10003023
Security and privacy Software security engineering
500
10002978.10003006.10003007.10003009
Security and privacy Trusted computing
500
10002978.10003001.10003599.10011621
Security and
arXiv
Machine Learning with Confidential Computing: A Systematization of Knowledge
arxiv_fulltext·2024-06-03
Machine Learning with Confidential Computing: A Systematization of Knowledge
Machine Learning with Confidential Computing: A Systematization of Knowledge
Fan Mo
Imperial College London
London
UK
Zahra Tarkhani
Microsoft Research
Cambridge
UK
Hamed Haddadi
Imperial College London
London
UK
## Abstract
Privacy and security challenges in Machine Learning (ML) have become increasingly severe, along with ML's pervasive development and the recent demonstration of large attack surfaces.
As a mature system-oriented approach, Confidential Computing has been utilized in both academia and industry to mitigate privacy and security issues in various ML scenarios.
In this paper, the conjunction between ML and Confidential Computing is investigated. We systematize the prior work on Confidential Computing-assisted ML techniques that provide i) confidentiality guarantees an
arXiv
WeSee: Using Malicious #VC Interrupts to Break AMD SEV-SNP
arxiv_fulltext·2024-04-04
WeSee: Using Malicious #VC Interrupts to Break AMD SEV-SNP
: Using Malicious #VC Interrupts to Break AMD SEV-SNP
Identify applicable funding agency here. If none, delete this.
Benedict Schlüter Supraja Sridhara Andrin Bertschi Shweta Shinde
ETH Zurich
## Abstract
AMD SEV-SNP offers VM-level trusted execution environments (TEEs) to protect the confidentiality and integrity for sensitive cloud workloads from untrusted hypervisor controlled by the cloud provider.
AMD introduced a new exception, , to facilitate the communication between the VM and the untrusted hypervisor.
We present attack, where the hypervisor injects malicious into a victim VM's CPU to compromise the security guarantees of AMD SEV-SNP.
Specifically, injects interrupt number 29, which delivers a exception to the VM who then executes the corresponding handler that performs data a
Bugzilla
CVE-2024-25742 CVE-2024-25743 hw: amd: Instruction raise #VC exception at exit
bugzilla·2024-03-21·CVSS 6.5
CVE-2024-25742 [MEDIUM] CVE-2024-25742 CVE-2024-25743 hw: amd: Instruction raise #VC exception at exit
CVE-2024-25742 CVE-2024-25743 hw: amd: Instruction raise #VC exception at exit
A vulnerability was found in AMD SEV-SNP (named "WeSee"), in this flaw, the hypervisor can inject a malicious #VC into a CPU that is executing a SEV-SNP VM at any time. Specifically, the hypervisor has the ability to inject external interrupts to the CPUs, including #VC which is yet another exception.
It is seen that SEV-SNP invokes the #VC exception handler in the VM without checking the authenticity of the root cause. Specifically, the VC handler does not check if the VM indeed executed an instruction that would legitimately cause the CPU to generate a #VC exception.
The VC handler performs sensitive operations of copying data between the VM and the hypervisor to emulate the semantics of the instruction tha
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e3ef461af35a8c74f2f4ce6616491ddb355a208fhttps://github.com/torvalds/linux/commit/e3ef461af35a8c74f2f4ce6616491ddb355a208fhttps://www.amd.com/en/resources/product-security/bulletin/amd-sb-3008.htmlhttps://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e3ef461af35a8c74f2f4ce6616491ddb355a208fhttps://github.com/torvalds/linux/commit/e3ef461af35a8c74f2f4ce6616491ddb355a208fhttps://www.amd.com/en/resources/product-security/bulletin/amd-sb-3008.html
2024-05-17
Published