An attacker can exploit this flaw to cause a denial of service (DoS) by creating a VM instance that triggers SEV instruction exception, resulting in a host CPU halt.
This flaw can be exploited when a host user launches an application with a specific condition that causes the SEV instruction to be triggered. It can be done by running an application on a SEV-enabled AMD CPU that has a specific condition that causes the SEV instruction to be triggered.
The flaw can be exploited only by non-root users via non-standard applications with specific conditions that trigger the SEV instruction to be executed. An attacker needs to run a non-standard application on a SEV-enabled AMD CPU that has a specific condition that causes the SEV instruction to be executed. An attacker can exploit this issue by running a non-standard application on a SEV-enabled AMD CPU that has a specific condition that causes the SEV instruction to be executed. This issue can be exploited by non-root users via non-standard applications with specific conditions that trigger the SEV instruction to be executed. Users who are familiar with AMD CPUs can exploit this issue by running a non-standard application on a SEV-enabled AMD CPU that has a specific condition that causes the SEV instruction to be executed. This issue can be exploited only via non-standard applications with specific conditions that trigger the SEV instruction to be executed.
Vulnerability Scenario
An attacker can exploit this issue by running a non-standard application on a SEV-enabled AMD CPU that has a specific condition that causes the SEV instruction to be executed. This issue can be exploited only via non-standard applications with specific conditions that trigger the SEV instruction to be executed.
A user who is familiar with AMD CPUs can exploit this issue by running a non-standard application on a SEV-enabled AMD CPU that has a specific condition that causes the SEV instruction to be executed.
Timeline
Published on: 08/26/2022 18:15:00 UTC
Last modified on: 11/01/2022 23:15:00 UTC
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2038940
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=683412ccf61294d727ead4a73d97397396e69a6b
- https://access.redhat.com/security/cve/CVE-2022-0171
- https://www.debian.org/security/2022/dsa-5257
- https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-0171