Input validation

Insufficient validation of elliptic curve points in SEV-legacy firmware may compromise SEV-legacy guest migration potentially resulting in loss of guest's integrity or confidentiality...

Denial of service

A bug with the SEV-ES TMR may lead to a potential loss of memory integrity for SNP-active VMs...

CVE-2021-26324

CVE-2021-26324 concerns a bug in the SEV-ES TMR that may lead to a loss of memory integrity for SNP-active VMs on AMD EPYC platforms. The available documents do not provide an attacker’s exploit path or exploitability details. The AMD security bulletin AMD-SB-1021 maps this CVE to affected EPYC g...

CVE-2021-26324

A bug with the SEV-ES TMR may lead to a potential loss of memory integrity for SNP-active VMs...

CVE-2021-26332

CVE-2021-26332 describes a vulnerability in AMD Secure Encrypted Virtualization (SEV) related to failing to verify that SEV-ES TMR is not in MMIO space, potentially allowing integrity or availability loss. The affected component is SEV-ES TMR handling; root cause is improper verification in memor...

CVE-2021-26332

Failure to verify SEV-ES TMR is not in MMIO space, SEV-ES FW could result in a potential loss of integrity or availability...

CVE-2021-26408

Insufficient validation of elliptic curve points in SEV-legacy firmware may compromise SEV-legacy guest migration potentially resulting in loss of guest's integrity or confidentiality...

CVE-2021-26408

The CVE-2021-26408 issue affects AMD SEV-legacy firmware, where insufficient validation of elliptic curve points during SEV-legacy guest migration could lead to loss of guest integrity or confidentiality. This is rooted in inadequate point validation within SEV-legacy firmware. According to the c...

kernel: KVM: SVM: out-of-bounds read/write in sev_es_string_io

A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State SEV-ES. A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a malicious VMGEXIT for a string I/O instruction for example, outs or ins using the exit...

PT-2022-9758

Name of the Vulnerable Software and Affected Versions SEV-legacy firmware affected versions not specified Description The issue is related to insufficient validation of elliptic curve points in the firmware, which may compromise the integrity or confidentiality of guests during migration...

CVE-2021-26332: Undefined Security Weakness

Failure to verify SEV-ES TMR is not in MMIO space, SEV-ES FW could result in a potential loss of integrity or availability...

PT-2022-9726

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description The issue is related to the failure to verify that SEV-ES TMR is not in MMIO space, which could result in a potential loss of integrity or availability due to SEV-ES FW. Recommendations A...

CVE-2021-26324: Undefined Security Weakness

A bug with the SEV-ES TMR may lead to a potential loss of memory integrity for SNP-active VMs...

CVE-2021-26408: Undefined Security Weakness

Insufficient validation of elliptic curve points in SEV-legacy firmware may compromise SEV-legacy guest migration potentially resulting in loss of guest's integrity or confidentiality...

PT-2022-9725

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description A bug related to the SEV-ES TMR may cause a potential loss of memory integrity for SNP-active VMs. Recommendations At the moment, there is no information about a newer version that...

Release of Technical Report into the AMD Security Processor

Posted by James Forshaw, Google Project Zero Today, members of Project Zero and the Google Cloud security team are releasing a technical report on a security review of AMD Secure Processor ASP. The ASP is an isolated ARM processor in AMD EPYC CPUs that adds a root of trust and controls secure...

Ciphertext Side Channels on AMD SEV

Bulletin ID: AMD-SB-1033 Potential Impact: Data leakage Severity: Medium Summary AMD received notification of a potential security vulnerability where data in specific cryptographic algorithms can be inferred in a SEV guest by monitoring the ciphertext values over time. Researchers from the...

GSD-2022-1001098 x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO

x86/sev: Unroll string mmio with CCATTRGUESTUNROLLSTRINGIO This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

PT-2022-29553

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.17 through v5.17.1 Description The issue concerns the initialization of psp ret in the sev platform init locked function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-29371

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.2 Description The issue concerns an unroll string mmio with CC ATTR GUEST UNROLL STRING IO in x86/sev. It was introduced in version v4.15 and fixed in version v5.17.2. The actual impact and attack...