x86-64.net

Processor vulnerability

CVE-2021-26342

In SEV guests the processor could skip a TLB flush after creating a new virtual machine control block, and the microcode then used stale translations.

Name
Missed TLB flush after a new VMCB
Vulnerability
AMD SEV, SEV-ES and SEV-SNP
Kind
Other
CVE published
2022-05-11 CVE record
Advisories
AMD-SB-1028
The issue is in the processor, not the hypervisor: after a particular sequence of operations that includes creating a new VMCB, the processor may not flush the TLB, and the microcode can go on using stale translations, which could disclose the memory of an SEV guest. SEV-ES and SEV-SNP guests are not affected. AMD’s bulletin lists the first and third generations of EPYC as affected, not the second, and fixed them in their platform initialization firmware.

Affected processors

2 of the 3 microarchitectures listed are affected in all or some of their models.

What the sources say of each microarchitecture.
MicroarchitectureStatusDetailSource
ZenAffectedFirst generation EPYC: NaplesPI-SP3 1.0.0.Hamd.com
Zen 3AffectedThird generation EPYC: MilanPI-SP3 1.0.0.7amd.com
Zen 2Not affectedSecond generation EPYC: not applicable, by the bulletinamd.com

Mitigations

  • Firmware: NaplesPI-SP3 1.0.0.H and MilanPI-SP3 1.0.0.7, from the board maker. Source.

Sources

  1. AMD-SB-1028: AMD Server Vulnerabilities, May 2022