Linux Kernel SEV Flaw Lets Guest Users Escalate Privileges or Crash Systems

A vulnerability tracked as CVE-2023-46813 affects the Linux kernel's handling of AMD Secure Encrypted Virtualization (SEV) guests. A low-privileged local user in an SEV virtual machine can use MMIO/string I/O exception-emulation paths to trigger a buffer overflow or null-pointer dereference, potentially causing a denial of service or escalating privileges. Red Hat rates the issue CVSS 7.0 and categorizes it as improper privilege management (CWE-269).

Linux fixed the flaw by adding validation in the x86 SEV exception-emulation code before string I/O reads and writes. The new vc_insn_string_check() rejects user-space I/O operations whose addresses point into kernel space and raises a user page fault instead. Red Hat issued fixes for affected RHEL 8 and RHEL 9 kernel variants and Red Hat Virtualization 4 on RHEL 8; it reported no generally suitable mitigation beyond applying the relevant updates.