Loading story…
A vulnerability tracked as CVE-2023-46813 affects the Linux kernel's handling of AMD Secure Encrypted Virtualization (SEV) guests. A low-privileged local user in an SEV virtual machine can use MMIO/string I/O exception-emulation paths to trigger a buffer overflow or null-pointer dereference, potentially causing a denial of service or escalating privileges. Red Hat rates the issue CVSS 7.0 and categorizes it as improper privilege management (CWE-269).
Linux fixed the flaw by adding validation in the x86 SEV exception-emulation code before string I/O reads and writes. The new vc_insn_string_check() rejects user-space I/O operations whose addresses point into kernel space and raises a user page fault instead. Red Hat issued fixes for affected RHEL 8 and RHEL 9 kernel variants and Red Hat Virtualization 4 on RHEL 8; it reported no generally suitable mitigation beyond applying the relevant updates.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:0897 and RHSA-2024:0881, fixing CVE-2023-46813 in the RHEL 8 kernel and kernel-rt packages.
Red Hat issued RHSA-2024:0724 to fix the flaw in the RHEL 8.6 Extended Update Support kernel and Red Hat Virtualization 4 for RHEL 8.
Red Hat addressed CVE-2023-46813 in the RHEL 8.8 Extended Update Support kernel through RHSA-2024:0575.
Red Hat issued fixes for the RHEL 9 kernel, RHEL 9.0 EUS kernel and kernel-rt, and RHEL 9.2 EUS kernel and kernel-rt through RHSA-2024:0461, RHSA-2024:0432, RHSA-2024:0431, RHSA-2024:0448, and RHSA-2024:0439.
CVE-2023-46813, a Linux kernel AMD SEV flaw involving a buffer overflow and null-pointer dereference triggered through MMIO-register access from an SEV guest, was made public. A low-privileged local attacker could crash the system or escalate privileges.
The Linux kernel added checks to its x86 SEV exception-emulation path to reject user-mode string I/O operations targeting kernel-space addresses, raising a user page fault instead of continuing the access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-25742** and **CVE-2024-25743** (WeSee) affect Linux virtual machines protected by AMD Secure Encrypted Virtualization–Secure Nested Paging (SEV-SNP). A malicious hypervisor can inject forged `#VC` exceptions, including interrupt `0x80`, and manipulate the guest's `EAX` register. Because the guest handler may emulate an instruction without authenticating that it caused the exception, an attacker can induce writes of attacker-controlled data or disclose sensitive guest data, compromising VM confidentiality and integrity. Red Hat rated each flaw moderate severity with a CVSS v3.1 score of **7.1** and released kernel fixes for affected Red Hat Enterprise Linux 8 and 9 streams, including selected Extended Update Support releases. Organizations operating SEV-SNP workloads should apply the applicable RHEL kernel updates and treat the hypervisor as a critical trust boundary; RHEL 6 and 7 `kernel` and `kernel-rt` packages are listed as not affected.
Aug 26, 2026
**CVE-2022-1852** is a moderate-severity NULL-pointer dereference in the Linux kernel's x86 KVM instruction-emulation path. A low-privileged attacker in an Intel-based virtual-machine guest can execute an illegal instruction and trigger a fault in `x86_emulate_insn`, causing a denial of service. Red Hat assigned a CVSS v3.1 score of 5.5 and classified the defect as CWE-476. The upstream Linux fix, commit `fee060cd52d69c114b62d1a2948ea9648b5131f9`, prevents KVM from invoking the x86 emulator before an instruction has been decoded, avoiding use of stale emulation context after breakpoint-related handling. Red Hat released corrected kernel packages for affected RHEL 8 and RHEL 9 systems and related products; RHEL 6 and 7 kernels are not affected. Where patching cannot be performed promptly, Red Hat recommends blacklisting the affected KVM kernel module at boot to prevent it from loading.
Aug 26, 2026
**CVE-2022-39189** affects the Linux kernel’s x86 KVM subsystem, where instruction emulation can leave the `KVM_VCPU_PREEMPTED` flag set and mishandle paravirtualized TLB flushes. Other guest vCPUs may then skip required TLB-flush IPIs while emulation accesses memory using stale guest-virtual translations, enabling an unprivileged user inside a VM to compromise the guest kernel or cause guest malfunction. The issue affects the `KVM_FEATURE_PV_TLB_FLUSH` functionality introduced in Linux 4.16 and was demonstrated through emulated VMMCALL and port-I/O operations. The upstream correction, commit `6cd88243c7e03845a450795e134b488fc2afb736`, was merged for Linux 5.19 and backported to the stable 5.15 and 5.18 kernel trees; affected kernels are generally versions before 5.18.17. Red Hat rated the vulnerability Moderate with CVSS 7.0 and issued fixes for affected RHEL 8, RHEL 8 kernel-rt, RHEL 8.6 EUS, RHEL 9, RHEL 9 kernel-rt, and Red Hat Virtualization 4 on RHEL 8 packages; Red Hat reported no qualifying mitigation, making deployment of the relevant kernel updates the required remediation.
Aug 26, 2026