x86-64.net

Processor vulnerability

CVE-2021-26340

A malicious hypervisor can skip the TLB flush an SEV or SEV-ES guest needs, so that a process of the attacker in the guest uses stale translations.

Name
TLB poisoning of SEV guests
Vulnerability
AMD SEV, SEV-ES and SEV-SNP
Kind
Other
CVE published
2021-12-10 CVE record
Advisories
AMD-SB-1023
Under SEV and SEV-ES the hypervisor decides when a guest’s TLB entries are flushed. If it leaves out a flush, a process it controls inside the guest can reuse translations of another process of that guest, which breaks the guest’s integrity and confidentiality. Under SEV-SNP the processor enforces the flushes itself, so AMD considers SNP guests not affected and offers no other mitigation; the earlier EPYC generations have no SEV-SNP.

Affected processors

3 of the 3 microarchitectures listed are affected in all or some of their models.

What the sources say of each microarchitecture.
MicroarchitectureStatusDetailSource
ZenAffectedFirst generation EPYC: no SEV-SNPamd.com
Zen 2AffectedSecond generation EPYC: no SEV-SNPamd.com
Zen 3Some modelsThird generation EPYC: SEV and SEV-ES guests; SEV-SNP guests are not affectedamd.com

Mitigations

  • Hardware: SEV-SNP, under which the processor enforces the TLB flushes a guest needs. Source.

Sources

  1. AMD-SB-1023: TLB Poisoning Attacks on AMD Secure Encrypted Virtualization (SEV)