x86-64.net

Processor vulnerability

CVE-2021-26311

Under SEV and SEV-ES a hypervisor can rearrange a guest's memory without the launch attestation noticing, which can lead to code execution in the guest.

Name
Rearranged guest memory that attestation misses
Also known as
undeSErVed trust
Vulnerability
AMD SEV, SEV-ES and SEV-SNP
Kind
Firmware
CVE published
2021-05-13 CVE record
Advisories
AMD-SB-1004
The attestation of SEV and SEV-ES does not notice when a hypervisor rearranges the pages of a guest’s memory in its address space, so a guest that passes attestation can still be made to run code in an order its owner did not intend. Researchers from the University of Luebeck showed this in the paper AMD names (undeSErVed trust, WOOT 2021). As with CVE-2020-12967, the attacker needs control of the hypervisor, and AMD’s mitigation is SEV-SNP on the third generation of EPYC and later.

Affected processors

3 of the 3 microarchitectures listed are affected in all or some of their models.

What the sources say of each microarchitecture.
MicroarchitectureStatusDetailSource
ZenAffectedFirst generation EPYC (7001): no SEV-SNP, no fixamd.com
Zen 2AffectedSecond generation EPYC (7002): no SEV-SNP, no fixamd.com
Zen 3AffectedThird generation EPYC (7003): mitigated by SEV-SNPamd.com

Mitigations

  • Hardware: SEV-SNP, on the third generation of EPYC and later. Source.

Sources

  1. AMD-SB-1004: AMD Secure Encrypted Virtualization