igvm

igvm This project is the home of the Independent Guest Virtual Machine IGVM file format. The format specification can be found in the igvmdefs crate, with a Rust implementation of the binary format in the igvm crate. The IGVM file format is designed to encapsulate all information required to laun...

cve-2023-20573-poc

PoC Usage This repo contains a VMM that boots an SEV-SNP guest with a custom kernel. The VMM and kernel are a stripped-down version of a project of mine. A modified Linux kernel is required to run on the host: https://github.com/Freax13/linux/tree/for-amd. The Proof of Concept can be run like thi...

cve-2023-31355-poc

SEV Firmware Vulnerability This repo contains an exploit for a vulnerability in the SEV firmware. The exploit allows decrypting arbitrary memory of an SEV-SNP guest after it's been decommissioned. Tested on version 1.55.16 latest as of time of writing. Root Cause snpreclaimbuffer unconditionally...

cve-2023-46813-poc

CVE-2023-46813 PoC 1. Apply the patches in the host-patches folder to the Linux host and QEMU. 2. Start an SEV-SNP VM. 3. Run the code in this repo and wait for the message "waiting for the hypervisor to change memory to MMIO". 4. Spam the attack command in QEMU several times. 5. Once the exploit...

cve-2024-21978-poc

SEV Firmware Vulnerability This repo contains an exploit for a vulnerability in the SEV firmware. The exploit allows decrypting arbitrary memory of a running SEV-SNP guest. Tested on version 1.55.16 latest as of the time of writing. Root Cause The nvpaddr field of the SEVINITEX command can be use...

cve-2024-21980-poc

SEV Firmware Vulnerability This repo contains an exploit for a vulnerability in the SEV firmware. The exploit allows decrypting arbitrary memory of an SEV-SNP guest after it's been decommissioned. Tested on version 1.55.16 latest as of time of writing. Root Cause The SEV firmware has a table call...

CVE-2026-90040

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component, specifically affecting Secure Encrypted Virtualization-Secure Nested Paging SEV-SNP virtual machines. When a guest memory page backing a Virtual Machine Save Area VMSA is invalidated, KVM may fail to properly free...

CVE-2026-98871

The Linux kernel contains a potential deadlock vulnerability within the crypto: ccp component during the SEV init failure path . Specifically, the function __sev_platform_init_handle_init_ex_path() calls rmp_mark_pages_firmware() with locked=false, even though the parent function has already acqu...

EUVD-2026-108717

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix possible deadlock in SEV init failure path sevplatforminithandleinitexpath calls rmpmarkpagesfirmware with locked=false while the parent function of initexpath already acquired the sevcmdmutex. In the case of an...

CVE-2026-98871

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix possible deadlock in SEV init failure path sevplatforminithandleinitexpath calls rmpmarkpagesfirmware with locked=false while the parent function of initexpath already acquired the sevcmdmutex. In the case of an...

cve-2023-31346-poc

Firmware Memory Leak The code here aims to demonstrate the memory leaks in guest messages headers and the CPUID request guest message. Prerequisites Install rustup. Install a Linux kernel with SEV-SNP host support. I used a kernel with my a few of own patches...

CVE-2026-98719

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem for AMD SEV Secure Encrypted Virtualization. This vulnerability occurs due to a double-free issue when memory allocated during virtual machine initialization is freed twice following an initialization failure. A loc...

CVE-2026-98718

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem supporting AMD SEV Secure Encrypted Virtualization. During virtual machine migration on the same host, CPU cache maintenance was performed after deactivating the source guest's encryption state instead of before. Th...

POC_CVE-2025-29943_Write-what-where-Condition

StackWarp: PoC for CVE-2025-29943 Proof of concept for the StackWarp hardware vulnerability CVE-2025-29943 in AMD processors. This flaw allows an attacker with administrator privileges on a host hypervisor to manipulate the CPU pipeline configuration to corrupt the stack pointer within a SEV-SNP...

CVE-2026-53360-POC

CVE-2026-53360: KVM SEV-SNP PSC heap out-of-bounds Proof of concept for a heap out-of-bounds read and write in KVM's SEV-SNP Page State Change PSC handling. A malicious SEV-SNP guest makes the host kernel walk a PSC entry array off the end of its slab allocation. That leaks the layout of...

CVE-2026-98472

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine AMD SEV Secure Encrypted Virtualization implementation. This flaw allows a local user with permissions to manage virtual machines to cause a denial of service DoS through memory exhaustion. When an SEV guest is destroyed afte...

CVE-2026-98471

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem for AMD SEV Secure Encrypted Virtualization. During intra-host migration of an encrypted virtual machine, the source virtual machine's CPU caches are not properly flushed before the system reclaims its memory. A loc...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31699)

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed When retrieving the PEK CSR, don't attempt to copy the blob to userspace if the firmware command failed. If the failure was due to an invalid length, i.e...

Linux Distros Unpatched Vulnerability : CVE-2026-98719

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: SEV: Nullify have run CPUs mask pointer when freeing it Nullify haveruncpus when freeing the mask, particularly in the error path of sevguestinit, so that...

Linux Distros Unpatched Vulnerability : CVE-2026-98718

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: SEV: Do cache maintenance on the source VM before clearing SEV state Explicitly flush caches after intra-host migration before clearing SEV active on the...