Ubuntu kernel HWE flaws affect AMD SEV-SNP and Arm TLB checks
Original title: USN-9066-1: Linux kernel (HWE) vulnerabilities
USN-9066-1 covers a local hypervisor RMP flaw (CVE-2023-20585) and an Arm TLB invalidation issue; the notice text is cut off.
Ubuntu security notice USN-9066-1 describes Linux kernel (HWE) vulnerabilities. Some AMD processors may skip Reverse Map Table checks when the IOMMU accesses certain host buffers, letting a local attacker with hypervisor access trigger an out-of-bounds condition and compromise SEV-SNP guest memory integrity (CVE-2023-20585). Some Arm processors can finish a broadcast TLB invalidation before related memory writes are globally observed, which a local attacker could use to write after permission was revoked. The published snippet ends before further details.
Unconfirmed: The notice snippet is truncated, so additional CVEs, affected versions, and fixes are not stated here.
- CVE-2023-20585 concerns AMD RMP checks during IOMMU access to host buffers.
- The AMD issue requires local hypervisor access and can affect SEV-SNP guest memory integrity.
- The Arm issue involves broadcast TLB invalidation completing too early.
- Fixed kernel versions are not included in the available snippet.
Impact: Local hypervisor access can compromise SEV-SNP guest memory integrity
| Product | Affected |
|---|---|
| Canonical Linux kernel (HWE) | — |
| AMD processors with SEV-SNP | some AMD processors |
| Arm processors | some Arm processors |
- 1.Review USN-9066-1 and install the Ubuntu HWE kernel updates it specifies.
- CVEs
- CVE-2023-20585
- Products
- Linux kernel (HWE)
- Organizations
- Ubuntu
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-20585 | Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds… | 5.6 | <1% |
From the original article
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.