CVE-2023-4155: Sev-es / sev-snp vmgexit double fetch vulnerability
A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the VMGEXIT handler recursively. If an attacker manages to call the handler multiple times, they can trigger a stack overflow and cause a denial of service or potentially guest-to-host escape in kernel configurations without stack guard pages (CONFIGVMAPSTACK).
Other sources
A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the VMGEXIT handler recursively. If an attacker manages to call the handler multiple times, they can theoretically trigger a stack overflow and cause a denial-of-service or potentially guest-to-host escape in kernel configurations without stack guard pages (CONFIGVMAPSTACK).
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by a race condition in KVM AMD Secure Encrypted Virtualization (SEV). By sending a specially crafted request using the VMGEXIT handler recursively, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-4155?
CVE-2023-4155 is classified as high severity due to the potential for a double fetch race condition vulnerability.
How do I fix CVE-2023-4155?
To fix CVE-2023-4155, you should update to the latest kernel version provided by your distribution that includes the patches for this vulnerability.
What systems are affected by CVE-2023-4155?
CVE-2023-4155 affects KVM guests using SEV-ES or SEV-SNP in several Linux distributions, including specific versions of Red Hat Enterprise Linux and Fedora.
What impact does CVE-2023-4155 have on my system?
CVE-2023-4155 can allow an attacker to invoke the VMGEXIT handler recursively, potentially leading to denial of service or unauthorized access.
How can I determine if my system is vulnerable to CVE-2023-4155?
To determine if your system is vulnerable to CVE-2023-4155, check if you are using a susceptible version of the Linux kernel with SEV-ES or SEV-SNP configurations.