Loading story…
CVE-2024-25742 and CVE-2024-25743 (WeSee) affect Linux virtual machines protected by AMD Secure Encrypted Virtualization–Secure Nested Paging (SEV-SNP). A malicious hypervisor can inject forged #VC exceptions, including interrupt 0x80, and manipulate the guest's EAX register. Because the guest handler may emulate an instruction without authenticating that it caused the exception, an attacker can induce writes of attacker-controlled data or disclose sensitive guest data, compromising VM confidentiality and integrity.
Red Hat rated each flaw moderate severity with a CVSS v3.1 score of 7.1 and released kernel fixes for affected Red Hat Enterprise Linux 8 and 9 streams, including selected Extended Update Support releases. Organizations operating SEV-SNP workloads should apply the applicable RHEL kernel updates and treat the hypervisor as a critical trust boundary; RHEL 6 and 7 kernel and kernel-rt packages are listed as not affected.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:3138 for the RHEL 8 kernel and RHSA-2024:2950 for kernel-rt to address CVE-2024-25742 and CVE-2024-25743.
Red Hat issued RHSA-2024:2758, fixing the affected RHEL 9 kernel for CVE-2024-25742 and CVE-2024-25743.
Red Hat released RHSA-2024:2627 for the RHEL 9.2 Extended Update Support kernel and RHSA-2024:2628 for kernel-rt, addressing the SEV-SNP interrupt-injection vulnerabilities.
Researchers responsibly disclosed WeSee (CVE-2024-25742), a malicious #VC interrupt-injection attack against AMD SEV-SNP guests, to AMD. The attack can enable guest-state leakage, memory corruption, and arbitrary guest-memory reads and writes from a malicious hypervisor.
Red Hat issued RHSA-2024:3810, fixing the affected RHEL 8.8 Extended Update Support kernel for CVE-2024-25742 and CVE-2024-25743.
Red Hat released RHSA-2024:3421, providing a kernel fix for the affected RHEL 9.0 Extended Update Support stream.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
8 references tracked. Mallory keeps watching after this page renders.
arxiv.org
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A vulnerability tracked as **CVE-2023-46813** affects the Linux kernel's handling of AMD Secure Encrypted Virtualization (SEV) guests. A low-privileged local user in an SEV virtual machine can use MMIO/string I/O exception-emulation paths to trigger a buffer overflow or null-pointer dereference, potentially causing a denial of service or escalating privileges. Red Hat rates the issue **CVSS 7.0** and categorizes it as improper privilege management (`CWE-269`). Linux fixed the flaw by adding validation in the x86 SEV exception-emulation code before string I/O reads and writes. The new `vc_insn_string_check()` rejects user-space I/O operations whose addresses point into kernel space and raises a user page fault instead. Red Hat issued fixes for affected RHEL 8 and RHEL 9 kernel variants and Red Hat Virtualization 4 on RHEL 8; it reported no generally suitable mitigation beyond applying the relevant updates.
Aug 26, 2026
**CVE-2022-1852** is a moderate-severity NULL-pointer dereference in the Linux kernel's x86 KVM instruction-emulation path. A low-privileged attacker in an Intel-based virtual-machine guest can execute an illegal instruction and trigger a fault in `x86_emulate_insn`, causing a denial of service. Red Hat assigned a CVSS v3.1 score of 5.5 and classified the defect as CWE-476. The upstream Linux fix, commit `fee060cd52d69c114b62d1a2948ea9648b5131f9`, prevents KVM from invoking the x86 emulator before an instruction has been decoded, avoiding use of stale emulation context after breakpoint-related handling. Red Hat released corrected kernel packages for affected RHEL 8 and RHEL 9 systems and related products; RHEL 6 and 7 kernels are not affected. Where patching cannot be performed promptly, Red Hat recommends blacklisting the affected KVM kernel module at boot to prevent it from loading.
Aug 26, 2026
Researchers at **CISPA Helmholtz Center for Information Security** disclosed **StackWarp** (**CVE-2025-29943**), a microarchitectural weakness affecting **AMD Zen** CPUs that can undermine the integrity guarantees of **AMD SEV-SNP** “confidential VM” protections. The attack model assumes a **malicious insider with host/hypervisor control** who can run a parallel hyperthread and exploit a previously undocumented hypervisor-side control bit to manipulate the protected guest’s stack pointer behavior, particularly when **Simultaneous Multithreading (SMT)** is enabled. Reported impacts include the ability to recover sensitive data from SEV-SNP guests—such as **cryptographic private keys**—and to enable follow-on compromise scenarios like **bypassing OpenSSH password authentication** and **privilege escalation** within the VM. AMD issued patches (made available in **July 2025**) and later published a security bulletin rating the issue **low severity**, but the disclosure highlights ongoing risk that confidential computing isolation can be weakened by CPU-level behaviors; organizations running SEV-SNP should prioritize applying AMD’s updates and review SMT-related exposure in multi-tenant or high-trust boundary environments.
Jun 29, 2026