Loading vulnerability…
WeSee
WeSee is an exception-injection vulnerability affecting Linux kernels before 6.9 in AMD SEV-SNP and SEV-ES virtual machines. An untrusted hypervisor can inject virtual interrupt 29, delivering a forged VMM Communication Exception (#VC) at arbitrary points during guest execution. The guest #VC handler does not verify that a legitimate guest instruction generated the exception before exchanging register state and data with the hypervisor. Demonstrated attacks against SEV-SNP guests use this behavior to skip instructions, leak or corrupt registers, read and write arbitrary guest memory, and inject and execute kernel-space code.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation compromises the confidentiality and integrity guarantees of affected confidential virtual machines against a malicious hypervisor. Demonstrated SEV-SNP attacks recovered NGINX kernel TLS session-key material, modified guest firewall behavior, and executed injected kernel-space code to obtain a root shell. The detailed demonstrations concern SEV-SNP; equivalent demonstrated outcomes for SEV-ES are not established.
If you can’t patch tonight, do this now.
Until patched kernels are deployed, do not treat SEV-SNP or SEV-ES guests as protected from a malicious or compromised hypervisor. Restrict workloads requiring confidential-computing guarantees to trusted, patched host and guest environments; limit hypervisor administrative access; and use provider and platform controls that prevent untrusted parties from operating or modifying the VMM. A guest-only configuration change is not identified as a complete mitigation for a malicious hypervisor.
Patch, then assume compromise.
Upgrade the guest Linux kernel to version 6.9 or later, or install the distribution's kernel update containing the backported fix. For Echo linux packages, update linux and related packages to 6.9.7-1 or later. Applicable Red Hat fixes include RHEL 9.2 kernel 5.14.0-284.64.1.el9_2 and kernel-rt 5.14.0-284.64.1.rt14.349.el9_2, RHEL 9.0 kernel 5.14.0-70.101.1.el9_0, and RHEL 8.8 kernel 4.18.0-477.58.1.el8_8. Reboot after installing the kernel update so the fixed kernel takes effect.
No public exploits tracked yet. Mallory keeps watching.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.