igvm

igvm This project is the home of the Independent Guest Virtual Machine IGVM file format. The format specification can be found in the igvmdefs crate, with a Rust implementation of the binary format in the igvm crate. The IGVM file format is designed to encapsulate all information required to laun...

cve-2023-46813-poc

CVE-2023-46813 PoC 1. Apply the patches in the host-patches folder to the Linux host and QEMU. 2. Start an SEV-SNP VM. 3. Run the code in this repo and wait for the message "waiting for the hypervisor to change memory to MMIO". 4. Spam the attack command in QEMU several times. 5. Once the exploit...

cve-2023-31346-poc

Firmware Memory Leak The code here aims to demonstrate the memory leaks in guest messages headers and the CPUID request guest message. Prerequisites Install rustup. Install a Linux kernel with SEV-SNP host support. I used a kernel with my a few of own patches...

cve-2024-21978-poc

SEV Firmware Vulnerability This repo contains an exploit for a vulnerability in the SEV firmware. The exploit allows decrypting arbitrary memory of a running SEV-SNP guest. Tested on version 1.55.16 latest as of the time of writing. Root Cause The nvpaddr field of the SEVINITEX command can be use...

cve-2024-21980-poc

SEV Firmware Vulnerability This repo contains an exploit for a vulnerability in the SEV firmware. The exploit allows decrypting arbitrary memory of an SEV-SNP guest after it's been decommissioned. Tested on version 1.55.16 latest as of time of writing. Root Cause The SEV firmware has a table call...

POC_CVE-2025-29943_Write-what-where-Condition

StackWarp: PoC for CVE-2025-29943 Proof of concept for the StackWarp hardware vulnerability CVE-2025-29943 in AMD processors. This flaw allows an attacker with administrator privileges on a host hypervisor to manipulate the CPU pipeline configuration to corrupt the stack pointer within a SEV-SNP...

cve-2023-31355-poc

SEV Firmware Vulnerability This repo contains an exploit for a vulnerability in the SEV firmware. The exploit allows decrypting arbitrary memory of an SEV-SNP guest after it's been decommissioned. Tested on version 1.55.16 latest as of time of writing. Root Cause snpreclaimbuffer unconditionally...

cve-2023-20573-poc

PoC Usage This repo contains a VMM that boots an SEV-SNP guest with a custom kernel. The VMM and kernel are a stripped-down version of a project of mine. A modified Linux kernel is required to run on the host: https://github.com/Freax13/linux/tree/for-amd. The Proof of Concept can be run like thi...

The vulnerability of the sev_dbg_crypt() function in the arch/x86/kvm/svm/sev.c module of the virtualization subsystem on the Linux kernel-based x86 platform allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sevdbgcrypt function in the arch/x86/kvm/svm/sev.c module of the virtualization subsystem on the Linux kernel-based x86 platform is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to...

CVE-2026-53360-POC

CVE-2026-53360: KVM SEV-SNP PSC heap out-of-bounds Proof of concept for a heap out-of-bounds read and write in KVM's SEV-SNP Page State Change PSC handling. A malicious SEV-SNP guest makes the host kernel walk a PSC entry array off the end of its slab allocation. That leaks the layout of...

Linux Distros Unpatched Vulnerability : CVE-2026-80853

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for DE,ENCRYPT ops on SNP-enabled hosts When de,encrypting...

SUSE CVE-2026-80853

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for DE,ENCRYPT ops on SNP-enabled hosts When de,encrypting memory of an SEV or SEV-ES guest on an SNP-enabled host via a temporary buffer, allocate a full 4KiB page for the buffer to ensure the page...

CVE-2026-80853

CVE-2026-80853 affects the Linux kernel KVM subsystem on SNP-enabled hosts . When KVM performs {de,en}crypt operations for an SEV or SEV-ES guest, it used a sub-page allocation for its temporary buffer. On SNP platforms, pages written by firmware are temporarily transferred to Firmware ownership ...

CVE-2026-80853

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for DE,ENCRYPT ops on SNP-enabled hosts When de,encrypting memory of an SEV or SEV-ES guest on an SNP-enabled host via a temporary buffer, allocate a full 4KiB page for the buffer to ensure the page...

CVE-2026-80853 KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for DE,ENCRYPT ops on SNP-enabled hosts When de,encrypting memory of an SEV or SEV-ES guest on an SNP-enabled host via a temporary buffer, allocate a full 4KiB page for the buffer to ensure the page...

EUVD-2026-71303

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for DE,ENCRYPT ops on SNP-enabled hosts When de,encrypting memory of an SEV or SEV-ES guest on an SNP-enabled host via a temporary buffer, allocate a full 4KiB page for the buffer to ensure the page...

The vulnerability of the get_ext_report() function in the drivers/virt/coco/sev-guest/sev-guest.c module of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the getextreport function in the drivers/virt/coco/sev-guest/sev-guest.c module of the Linux kernel is related to incorrect calculation of the buffer size. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

CVE-2026-80651

A flaw was found in the Linux kernel's crypto: ccp/sev-dev-tsm module. The dsmcreate function fails to properly validate the pdev-bus pointer, leading to a null pointer dereference. A local attacker could exploit this vulnerability to trigger a kernel crash, resulting in a Denial of Service DoS...

Linux Distros Unpatched Vulnerability : CVE-2026-80652

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to...

Linux Distros Unpatched Vulnerability : CVE-2026-80651

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: ccp/sev-dev-tsm - bail out early when pdev-bus is NULL dsmcreate initially checks pdev-bus when computing segmentid: u8 segmentid = pdev-bus ?...