KVM (AMD SEV-ES): Out-of-bounds read/write in sev_es_string_io() - malicious SEV-ES guest corrupts host memory

Impact

Out-of-bounds read/write in sev_es_string_io() - malicious SEV-ES guest corrupts host memory

Who can reach it

Tenant VM guest (SEV-ES)

What to do

Kernel/KVM patch + reboot. Directly relevant to any confidential-VM GPU offering

References

Related entries

• VMware ESXi / Workstation / Fusion: Heap out-of-bounds write in the USB 2.0 EHCI controllerCVE-2022-31705 · VMware ESXi / Workstation / FusionHigh
• Linux kernel (eBPF verifier): Incorrect verifier pruning marks unsafe paths as safeCVE-2023-2163 · Linux kernel (eBPF verifier)High
• Linux kernel SMC-R (fallback path, DECLINE message leaking into the application stream): Silent data corruption, whichCVE-2023-52775 · Linux kernel SMC-R (fallback path, DECLINE message leaking into the application stream)High
• QEMU (virtio): DMA reentrancy leads to double free across virtio devices - guest-to-host code execution in QEMUCVE-2024-3446 · QEMU (virtio)High
• Linux kernel (net/tls): A non-DATA record already copied out of the pending list could be merged with a second recordCVE-2024-58239 · Linux kernel (net/tls)High
• Intel ice driver (Ethernet 800 Series, Linux kernel mode): A missing check for an exceptional condition in theCVE-2025-20093 · Intel ice driver (Ethernet 800 Series, Linux kernel mode)High