CVE-2023-4155

2023-08-0900:00:00

ubuntu.com

kvm

amd

secure encrypted virtualization

sev

double fetch race

stack overflow

denial of service

guest-to-host escape

linux kernel

vmgexit handler

race condition

vulnerability

stack guard pages

bugzilla

red hat

suse

CVSS3

5.6

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

EPSS

Percentile

9.0%

JSON

A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the
Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can
trigger a double fetch race condition vulnerability and invoke the
VMGEXIT handler recursively. If an attacker manages to call the handler
multiple times, they can trigger a stack overflow and cause a denial of
service or potentially guest-to-host escape in kernel configurations
without stack guard pages (CONFIG_VMAP_STACK).

Bugs

OSVersionArchitecturePackageVersionFilename
ubuntu22.04noarchlinux< 5.15.0-86.96UNKNOWN
ubuntu23.04noarchlinux< 6.2.0-34.34UNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1047.52UNKNOWN
ubuntu23.04noarchlinux-aws< 6.2.0-1013.13UNKNOWN
ubuntu20.04noarchlinux-aws-5.15< 5.15.0-1047.52~20.04.1UNKNOWN
ubuntu22.04noarchlinux-aws-6.2< 6.2.0-1013.13~22.04.1UNKNOWN
ubuntu22.04noarchlinux-azure< 5.15.0-1049.56UNKNOWN
ubuntu23.04noarchlinux-azure< 6.2.0-1014.14UNKNOWN
ubuntu20.04noarchlinux-azure-5.15< 5.15.0-1049.56~20.04.1UNKNOWN
ubuntu22.04noarchlinux-azure-6.2< 6.2.0-1014.14~22.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	22.04	noarch	linux	< 5.15.0-86.96	UNKNOWN
ubuntu	23.04	noarch	linux	< 6.2.0-34.34	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< 5.15.0-1047.52	UNKNOWN
ubuntu	23.04	noarch	linux-aws	< 6.2.0-1013.13	UNKNOWN
ubuntu	20.04	noarch	linux-aws-5.15	< 5.15.0-1047.52~20.04.1	UNKNOWN
ubuntu	22.04	noarch	linux-aws-6.2	< 6.2.0-1013.13~22.04.1	UNKNOWN
ubuntu	22.04	noarch	linux-azure	< 5.15.0-1049.56	UNKNOWN
ubuntu	23.04	noarch	linux-azure	< 6.2.0-1014.14	UNKNOWN
ubuntu	20.04	noarch	linux-azure-5.15	< 5.15.0-1049.56~20.04.1	UNKNOWN
ubuntu	22.04	noarch	linux-azure-6.2	< 6.2.0-1014.14~22.04.1	UNKNOWN