x86-64.net

Processor vulnerability

CVE-2020-12967

Under SEV and SEV-ES the nested page tables are not protected, so a malicious hypervisor can inject code into an encrypted guest.

Name
Unprotected nested page tables of SEV guests
Also known as
SEVerity
Vulnerability
AMD SEV, SEV-ES and SEV-SNP
Kind
Other
CVE published
2021-05-13 CVE record
Advisories
AMD-SB-1004
A hypervisor still controls the nested page tables that map an SEV or SEV-ES guest’s memory. Researchers from Fraunhofer AISEC and the Technical University of Munich used that, in the paper AMD names (SEVerity, WOOT 2021), to run code of their choosing inside an encrypted guest. The attack needs a malicious administrator who controls the hypervisor. SEV-SNP closes it: its reverse map table lets the processor reject remapped guest pages. Earlier EPYC generations have no SEV-SNP, and AMD gives them no fix.

Affected processors

3 of the 3 microarchitectures listed are affected in all or some of their models.

What the sources say of each microarchitecture.
MicroarchitectureStatusDetailSource
ZenAffectedFirst generation EPYC (7001): no SEV-SNP, no fixamd.com
Zen 2AffectedSecond generation EPYC (7002): no SEV-SNP, no fixamd.com
Zen 3AffectedThird generation EPYC (7003): mitigated by SEV-SNPamd.com

Mitigations

  • Hardware: SEV-SNP, on the third generation of EPYC and later. Source.

Sources

  1. AMD-SB-1004: AMD Secure Encrypted Virtualization