AMD Secure Encrypted Virtualization

Bulletin ID: AMD-SB-1004 **Potential Impact:**Arbitrary Code Execution **Severity:**Medium

Summary

AMD is aware of 2 research papers related to AMD’s Secure Encrypted Virtualization (SEV) which will be presented at this year’s 15th IEEE Workshop on Offensive Technologies (WOOT’21).

In the paper titled “SEVerity: Code Injection Attacks against Encrypted Virtual Machines,” researchers from Fraunhofer AISEC, in partnership with Technical University of Munich, make use of previously discussed research around the lack of nested page table protection in the SEV/SEV-ES feature which could potentially lead to arbitrary code execution within the guest.

In the paper titled “undeSErVed trust: Exploiting Permutation-Agnostic Remote Attestation,” researchers from University of Lubeck demonstrate that in the SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a malicious hypervisor to potentially lead to arbitrary code execution within the guest.

The exploits mentioned in both papers require a malicious administrator to have access in order to compromise the server hypervisor.

CVE Details

See Above

Affected Products

1st/2nd/3rd Gen AMD EPYC™ Processors

AMD EPYC™ Embedded Processors

Mitigation

AMD has provided mitigation in the SEV-SNP feature which is available for enablement in 3rd Gen AMD EPYC™ processors.

The mitigation requires the use of SEV-SNP, which is only supported on 3rd Gen AMD EPYC™.

Prior generations of AMD EPYC™ do not support SEV-SNP. For earlier AMD EPYC™ products, AMD recommends following security best practices.

For additional information on SEV-SNP and SEV/SEV-ES please refer to our white paper in the References Section of this document.