Loading vulnerability…
Virtual Interrupt Injection in Linux AMD SEV-SNP Guests
CVE-2024-25743 affects Linux kernels through version 6.9 running as AMD SEV-SNP or SEV-ES guests. An untrusted or malicious hypervisor can inject virtual interrupts at arbitrary times, including interrupt vectors associated with exception handling and legacy system-call processing. This can cause user-space SIGFPE handler execution and, in the interrupt 0x80 case, permit alteration of the guest EAX register value. The flaw undermines the expected isolation boundary between the hypervisor and an encrypted Linux guest.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A malicious hypervisor can potentially compromise the confidentiality and integrity of an affected SEV-SNP Linux guest by manipulating guest execution through injected interrupts and register state. Red Hat assigned CVSS v3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impact with no stated availability impact.
If you can’t patch tonight, do this now.
No complete software-only mitigation is specified other than installing the corrected kernel. Until patched, do not run sensitive SEV-SNP or SEV-ES workloads under hypervisors that are outside the guest owner’s trust boundary.
Patch, then assume compromise.
Install the vendor-provided Linux kernel update containing the AMD-SN-3008 fixes for CVE-2024-25743, then reboot so the updated kernel is running. Red Hat fixes are available for affected RHEL 8 and RHEL 9 kernel streams, including applicable kernel-rt and extended-support streams.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.