cve-2023-31346-poc

Утечка памяти прошивки Код здесь предназначен для демонстрации утечек памяти в заголовках гостевых сообщений и в гостевом сообщении запроса CPUID. Предварительные требования Установите rustup. Установите ядро Linux с поддержкой SEV-SNP на хосте. Я использовал ядро с несколькими моими собственными...

igvm

igvm Ce projet est le siège du format de fichier Independent Guest Virtual Machine IGVM. La spécification du format se trouve dans la crate igvmdefs, avec une implémentation Rust du format binaire dans la crate igvm. Le format de fichier IGVM est conçu pour encapsuler toutes les informations...

cve-2024-21978-poc

SEV 펌웨어 취약점 이 저장소는 SEV 펌웨어의 취약점에 대한 익스플로잇을 포함합니다. 익스플로잇은 실행 중인 SEV-SNP 게스트의 임의 메모리를 복호화할 수 있습니다. 버전 1.55.16작성 시점 기준 최신에서 테스트되었습니다. 근본 원인 SEVINITEX 명령의 nvpaddr 필드는 펌웨어에 메모리 청크를 기증하는 데 사용될 수 있으며, 이를 통해 영구 플래시 대신 사용할 수 있습니다. SEV-SNP가 활성화된 경우 이 메모리는 FIRMWARE 상태여야 합니다. 펌웨어는 SEVINITEX 명령을 실행하는 동안 확인합니다...

cve-2024-21980-poc

Vulnérabilité du firmware SEV Ce dépôt contient un exploit pour une vulnérabilité dans le firmware SEV. L'exploit permet de déchiffrer la mémoire arbitraire d'un invité SEV-SNP après qu'il a été désaffecté. Testé sur la version 1.55.16 la plus récente au moment de la rédaction. Cause racine Le...

cve-2023-46813-poc

CVE-2023-46813 PoC 1. Appliquez les correctifs du dossier host-patches à l'hôte Linux et à QEMU. 2. Lancez une VM SEV-SNP. 3. Exécutez le code de ce dépôt et attendez le message "waiting for the hypervisor to change memory to MMIO". 4. Lancez plusieurs fois la commande attack dans QEMU. 5. Une fo...

cve-2023-31355-poc

Уязвимость в прошивке SEV В этом репозитории содержится эксплойт для уязвимости в прошивке SEV. Эксплойт позволяет расшифровывать произвольную память гостевой системы SEV-SNP после её вывода из эксплуатации. Проверено на версии 1.55.16 последней на момент написания. Первопричина snpreclaimbuffer...

cve-2023-20573-poc

Использование PoC Этот репозиторий содержит VMM, который загружает гостевую ОС SEV-SNP с пользовательским ядром. VMM и ядро представляют собой урезанную версию моего проекта. Для работы на хосте требуется модифицированное ядро Linux: https://github.com/Freax13/linux/tree/for-amd. Доказательство...

POC_CVE-2025-29943_Write-what-where-Condition

StackWarp: PoC для CVE-2025-29943 Проверка концепции для аппаратной уязвимости StackWarp CVE-2025-29943 в процессорах AMD. Эта ошибка позволяет атакующему с привилегиями администратора на хосте гипервизоре манипулировать конфигурацией конвейера ЦП для повреждения указателя стека внутри гостевой...

Rocky Linux 8 [CIQ] Security Update: iwl100-firmware / iwl1000-firmware / iwl105-firmware / etc Multiple Vulnerabilities (crlsa-2024_7481)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20247481 advisory. kernel: hw:amd:IOMMU improperly handles certain special address leading to a loss of guest integrity CVE-2023-20584 kernel: hw: amd:Incomplete system memor...

AlmaLinux 9.2 [TuxCare] Security Update: iwl100-firmware / iwl1000-firmware / iwl105-firmware / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1740470712)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1740470712 advisory. - IOMMU improperly handles certain special address ranges with invalid device table entries DTEs, which may allow an attacker with...

CVE-2026-53360-POC

CVE-2026-53360 : Dépassement de tas PSC SEV-SNP de KVM Preuve de concept pour une lecture et une écriture hors limites dans le tas heap out‑of‑bounds dans la gestion du changement d’état de page PSC SEV‑SNP de KVM. Un invité SEV‑SNP malveillant force le noyau hôte à parcourir un tableau d’entrées...

SUSE-SU-2026:23962-1 Security update for the Linux Kernel (Live Patch 9 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.30.1 fixes various security issues: The following security issues were fixed: - CVE-2026-46150: fanotify: fix false positive on permission events bsc1267388. - CVE-2026-53360: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in u...

SUSE-SU-2026:23960-1 Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.5.1 fixes various security issues: The following security issues were fixed: - CVE-2026-46150: fanotify: fix false positive on permission events bsc1267388. - CVE-2026-53360: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in us...

CVE-2026-100839

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack "BadAML". ACPI tables containing AML bytecode are passed from the untrusted host QEMU to the guest firmware OVMF and on to the Linu...

CVE-2026-100839 Contrast before 1.18.0 AML Injection Remote Code Execution

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack "BadAML". ACPI tables containing AML bytecode are passed from the untrusted host QEMU to the guest firmware OVMF and on to the Linu...

EUVD-2026-87849

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack "BadAML". ACPI tables containing AML bytecode are passed from the untrusted host QEMU to the guest firmware OVMF and on to the Linu...

CVE-2026-100839: Improper Control of Generation of Code

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack "BadAML". ACPI tables containing AML bytecode are passed from the untrusted host QEMU to the guest firmware OVMF and on to the Linu...

CVE-2026-92702

Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS aTLS AMD SEV-SNP verification path does not enforce attestation freshness when the expected reportData value is nil,...

EUVD-2026-83192

Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS aTLS AMD SEV-SNP verification path does not enforce attestation freshness when the expected reportData value is nil,...

CVE-2026-92702 Cocos AI: Intra-handshake attested TLS implementation can accept Evidence with nil, empty, or omitted reportData in the AMD SEV-SNP path

Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS aTLS AMD SEV-SNP verification path does not enforce attestation freshness when the expected reportData value is nil,...