WeSee Flaws Let Malicious Hypervisors Compromise AMD SEV-SNP Guests

CVE-2024-25742 and CVE-2024-25743 (WeSee) affect Linux virtual machines protected by AMD Secure Encrypted Virtualization–Secure Nested Paging (SEV-SNP). A malicious hypervisor can inject forged #VC exceptions, including interrupt 0x80, and manipulate the guest's EAX register. Because the guest handler may emulate an instruction without authenticating that it caused the exception, an attacker can induce writes of attacker-controlled data or disclose sensitive guest data, compromising VM confidentiality and integrity.

Red Hat rated each flaw moderate severity with a CVSS v3.1 score of 7.1 and released kernel fixes for affected Red Hat Enterprise Linux 8 and 9 streams, including selected Extended Update Support releases. Organizations operating SEV-SNP workloads should apply the applicable RHEL kernel updates and treat the hypervisor as a critical trust boundary; RHEL 6 and 7 kernel and kernel-rt packages are listed as not affected.