Linux Kernel Vulnerability in KVM Affecting AMD's SEV-ES and SEV-SNP Implementations

CVE-2024-55881

Summary

A vulnerability in the Linux kernel's KVM component can lead to improper handling of hypercalls for protected guests utilizing AMD's SEV-ES and SEV-SNP features. The issue arises from the incorrect detection of 64-bit hypercall mode during the exit process, where the state of the vCPU does not reveal whether a hypercall was made in 64-bit mode. This oversight could potentially allow unauthorized access or manipulation of virtual machine functionalities. Prompt patching is recommended to mitigate the risk associated with this vulnerability.

References