cve-2023-31355-poc

SEV Firmware Vulnerability This repo contains an exploit for a vulnerability in the SEV firmware. The exploit allows decrypting arbitrary memory of an SEV-SNP guest after it's been decommissioned. Tested on version 1.55.16 latest as of time of writing. Root Cause snpreclaimbuffer unconditionally...

Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8887-1)

"The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8887-1 advisory. It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local...

Ubuntu 24.04 LTS : Linux kernel vulnerabilities (USN-8917-1)

"The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8917-1 advisory. It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local...

Ubuntu 24.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8918-1)

"The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8918-1 advisory. It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local...

USN-8917-1: Linux kernel vulnerabilities

It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory...

USN-8917-1 linux, linux-aws, linux-aws-fips, linux-fips, linux-gcp, linux-gcp-fips, linux-gke, linux-gkeop, linux-ibm, linux-lowlatency, linux-oracle, linux-realtime vulnerabilities

It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory...

Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)

"The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8889-1 advisory. It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local...

cve-2024-21980-poc

SEV Firmware Vulnerability This repo contains an exploit for a vulnerability in the SEV firmware. The exploit allows decrypting arbitrary memory of an SEV-SNP guest after it's been decommissioned. Tested on version 1.55.16 latest as of time of writing. Root Cause The SEV firmware has a table call...

USN-8887-2: Linux kernel (AWS) vulnerabilities

It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory...

USN-8889-1: Linux kernel (OEM) vulnerabilities

It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory...

USN-8889-1 linux-oem-7.0 vulnerabilities

It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory...

USN-8888-1: Linux kernel (Azure) vulnerabilities

It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory...

USN-8888-1 linux-azure, linux-azure-fde vulnerabilities

It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory...

SUSE CVE-2026-90040

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Wire up a gmeminvalidaterange call for SNP VMs, and use it to force vCPUs to reload/recheck their guest-provided VMSA if the backing gmem page is being...

DEBIAN-CVE-2026-90040

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Wire up a gmeminvalidaterange call for SNP VMs, and use it to force vCPUs to reload/recheck their guest-provided VMSA if the backing gmem page is being...

CVE-2026-90040

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Wire up a gmeminvalidaterange call for SNP VMs, and use it to force vCPUs to reload/recheck their guest-provided VMSA if the backing gmem page is being...

CVE-2026-90040 KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Wire up a gmeminvalidaterange call for SNP VMs, and use it to force vCPUs to reload/recheck their guest-provided VMSA if the backing gmem page is being...

EUVD-2026-80648

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Wire up a gmeminvalidaterange call for SNP VMs, and use it to force vCPUs to reload/recheck their guest-provided VMSA if the backing gmem page is being...

PT-2026-93681

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM SEV implementation where the SNP VMSA Virtual Machine Save Area is not forcefully invalidated when its backing gmem page is zapped, such as during a PUNCH HOLE...

CVE-2026-90040: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Wire up a gmeminvalidaterange call for SNP VMs, and use it to force vCPUs to reload/recheck their guest-provided VMSA if the backing gmem page is being...