Linux kernel SEV-ES #VC handler - MMIO access checking: Incorrect access checking in the SEV-ES #VC handler and

CVSS 7.0CVE-2023-46813Firmware, BMC & network fabriccurated

Impact

Incorrect access checking in the SEV-ES #VC handler and instruction emulation lets a local user with userspace access to MMIO registers escalate. Inside a confidential VM, a merely local user reaches privileged guest state through the exception handler that SEV-ES uses to virtualise MMIO - so the confidential VM's own internal privilege boundary breaks, not just the host/guest one.

Who can reach it

Local, from userspace inside an SEV-ES guest that has userspace-accessible MMIO. Affects Linux before 6.5.9.

What to do

Fixed in the Linux kernel. Take the distro kernel update (RHEL/Rocky, Ubuntu, SLES) and reboot the host - no firmware, VBIOS or AGESA step. On a GPU fleet this is a cordon, drain and rolling reboot; plan it as normal kernel maintenance. The fix belongs in the **guest** kernel, so update your confidential-VM images (or publish a minimum guest kernel to tenants) rather than assuming host patching covers it.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-46813

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.