AMD SEV / SEV-ES - missing nested page table protection: SEV and SEV-ES do not protect the nested page tables, so a

Impact

SEV and SEV-ES do not protect the nested page tables, so a malicious hypervisor can remap the guest's physical address space underneath it. The SEVurity and SEVerity research chains turned this into arbitrary code execution inside the encrypted guest: because encryption is keyed by physical address and the host controls the mapping, the host can move ciphertext blocks around to assemble instructions of its choosing inside the victim VM. The guest's memory is encrypted and the attacker still gets code execution in it.

Who can reach it

Requires a malicious administrator who has compromised the hypervisor. Affects SEV and SEV-ES; SEV-SNP's reverse-map table is the architectural answer to exactly this.

What to do

**Not fixable on SEV or SEV-ES** - the missing protection is architectural, which is why AMD built SEV-SNP with the RMP. The remediation is a platform migration: run confidential workloads on SEV-SNP-capable EPYC (Milan 7003 and later) with SNP actually enabled, not on SEV or SEV-ES. If you are running SEV or SEV-ES today and telling customers their VMs are protected from you, that claim does not hold. Requires new hardware or at minimum a firmware/BIOS enablement pass plus reconfiguring your VMM to launch SNP guests.

References

Related entries

• ArubaOS GRUB2 implementation (secure boot): Two flaws in ArubaOS's GRUB2 implementation allow secure bootCVE-2020-24637 · ArubaOS GRUB2 implementation (secure boot)High
• Inspur NF5266M5 through firmware 3.21.2 and other Inspur M5-generation servers: An attacker with administrative reachCVE-2020-26122 · Inspur NF5266M5 through firmware 3.21.2 and other Inspur M5-generation serversHigh
• AMD SEV / SEV-ES - guest address space rearrangement undetected by attestation: A malicious hypervisor can rearrangeCVE-2021-26311 · AMD SEV / SEV-ES - guest address space rearrangement undetected by attestationHigh
• Intel TXT SINIT Authenticated Code Module for some Intel processors: Improper initialization in the SINIT ACMCVE-2022-30704 · Intel TXT SINIT Authenticated Code Module for some Intel processorsHigh
• Intel Xeon memory controller configuration (with SGX): Memory controller configuration registers are left withCVE-2022-33196 · Intel Xeon memory controller configuration (with SGX)High
• Intel Xeon processors (SGX/TDX error injection): Unauthorised error injection against SGX or TDX on affected Xeon partsCVE-2022-41804 · Intel Xeon processors (SGX/TDX error injection)High