441 matches found
igvm
igvm Este proyecto es el hogar del formato de archivo Independent Guest Virtual Machine IGVM. La especificación del formato se puede encontrar en la caja igvmdefs, con una implementación en Rust del formato binario en la caja igvm. El formato de archivo IGVM está diseñado para encapsular toda la...
IT19115276
IT19115276 Informe de la Tarea 1 de SNP: explotación de una máquina Linux Vulnerabilidad CVE-2014-0038 He explicado cómo explotar esta vulnerabilidad con capturas de pantalla...
cve-2023-31355-poc
SEV 固件漏洞 此仓库包含针对 SEV 固件中一个漏洞的利用程序。该利用程序允许在 SEV-SNP 客户机关闭后解密其任意内存。 已在 1.55.16 版本上测试（目前最新版）。 根因 snpreclaimbuffer 无条件地尝试写回 RMP 更改，即使地址不在 RMP 覆盖范围内。如果 address 不在 RMP 覆盖范围内，RMP 条目 pagermppaddr 的地址永远不会被正确初始化，并保持其初始值 0。因此固件尝试将 RMP 条目的更改写回地址 0。这很糟糕，因为地址 0 在 RMP 覆盖范围内，不应该在没有更多检查的情况下被写入。如果 address 在 RMP...
cve-2023-20573-poc
PoC 使用方法 本仓库包含一个 VMM，它使用自定义内核启动 SEV-SNP 虚拟机。该 VMM 和内核是我个人项目的一个精简版本。需要在主机上运行经过修改的 Linux 内核：https://github.com/Freax13/linux/tree/for-amd。 可按照以下方式运行概念验证： root@kitploit: cd host cargo run -p vmm 说明 该代码在两条指令之间来回跳转： root@kitploit: 2: nop jmp 2b 当 FLAGS 寄存器中的 TF 标志被设置时，异常应被生成，且指令指针将在两条指令之间交替。...
SNP
Este repositorio no tiene un README...
POC_CVE-2025-29943_Write-what-where-Condition
StackWarp: CVE-2025-29943 的 PoC 硬件漏洞 StackWarp （CVE-2025-29943）在 AMD 处理器上的概念验证。该漏洞允许主机（hypervisor）上具有管理员权限的攻击者操纵 CPU 流水线的配置，以破坏 SEV-SNP 客户虚拟机内的栈指针，从而导致权限提升和任意代码执行。 📋 漏洞概述 ID: CVE-2025-29943 产品: AMD EPYC 处理器（7003、8004、9004、9005 系列及其嵌入式变体） 受影响架构: AMD Zen 1 至 Zen 5 CWE-ID: CWE-123（Write-what-where 条...
cve-2023-46813-poc
CVE-2023-46813 PoC 1. Apply the patches in the host-patches folder to the Linux host and QEMU. 2. Start an SEV-SNP VM. 3. Run the code in this repo and wait for the message "waiting for the hypervisor to change memory to MMIO". 4. Spam the attack command in QEMU several times. 5. Once the exploit...
CVE-2026-53360-POC
CVE-2026-53360: KVM SEV-SNP PSC 堆越界 KVM 中 SEV-SNP 页面状态变更 PSC 处理的一个堆越界读取和写入概念验证。恶意 SEV-SNP 客户机使主机内核遍历 PSC 条目数组超出其 slab 分配末端。这会泄露相邻 kmalloc-cg-32 对象的布局，并向其中写入受控的小值，且客户机可以任意重复此操作。 完整文章：https://cyberstan.co.uk/sev-snp-oob/ | ---|--- CVE| CVE-2026-53360 组件| KVM SNP 主机支持，arch/x86/kvm/svm/sev.c 引入|...
CVE-2019-10149
CVE-2019-10149 SNP Assignment on a Linux vulnerability...
cve-2023-31346-poc
Fuga de Memoria del Firmware El código aquí tiene como objetivo demostrar las fugas de memoria en los encabezados de mensajes de invitado y en el mensaje de invitado de solicitud de CPUID. Prerrequisitos Instalar rustup. Instalar un kernel de Linux con soporte de host SEV-SNP. Utilicé un kernel c...
cve-2024-21978-poc
Vulnerabilidad en el firmware SEV Este repositorio contiene un exploit para una vulnerabilidad en el firmware SEV. El exploit permite descifrar memoria arbitraria de un invitado SEV-SNP en ejecución. Probado en la versión 1.55.16 la más reciente en el momento de escribir esto. Causa raíz El campo...
CVE-2026-92702
Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS aTLS AMD SEV-SNP verification path does not enforce attestation freshness when the expected reportData value is nil,...
CVE-2026-92702 Cocos AI: Intra-handshake attested TLS implementation can accept Evidence with nil, empty, or omitted reportData in the AMD SEV-SNP path
Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS aTLS AMD SEV-SNP verification path does not enforce attestation freshness when the expected reportData value is nil,...
EUVD-2026-83192
Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS aTLS AMD SEV-SNP verification path does not enforce attestation freshness when the expected reportData value is nil,...
CVE-2026-92702
Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2 , the intra-handshake attested TLS (aTLS) AMD SEV-SNP verification path does not enforce attestation freshness when the expected reportData value is ni...
CVE-2026-92702 Cocos AI: Intra-handshake attested TLS implementation can accept Evidence with nil, empty, or omitted reportData in the AMD SEV-SNP path
Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS aTLS AMD SEV-SNP verification path does not enforce attestation freshness when the expected reportData value is nil,...
CVE-2026-92702: Origin Validation Error
Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS aTLS AMD SEV-SNP verification path does not enforce attestation freshness when the expected reportData value is nil,...
DEBIAN-CVE-2026-90040
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Wire up a gmeminvalidaterange call for SNP VMs, and use it to force vCPUs to reload/recheck their guest-provided VMSA if the backing gmem page is being...
CVE-2026-90040
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Wire up a gmeminvalidaterange call for SNP VMs, and use it to force vCPUs to reload/recheck their guest-provided VMSA if the backing gmem page is being...