Executive brief
A flaw in the Linux kernel's AMD SEV (Secure Encrypted Virtualization) memory encryption handling causes data corruption during live migration of encrypted virtual machines. When memory pages are not aligned to page boundaries, the kernel incorrectly marks encryption status, leading to pages being migrated from the wrong security context. This can result in data loss or exposure during VM migration operations.
Technical details
The vulnerability exists in the enc_dec_hypercall() function in arch/x86/mm/mem_encrypt_amd.c, which incorrectly accepted a page count (npages) instead of a byte size parameter. This forced callers to round up non-page-aligned virtual addresses, causing the encryption status hypercall to spuriously mark additional pages as decrypted. The root cause is insufficient precision in tracking encryption status boundaries. The issue affects live migration of SEV-enabled VMs running on AMD EPYC systems. Local attackers with VM control or administrators performing live migration could trigger consistent page corruption. The fix changes the function signature to accept size in bytes rather than page count, eliminating the rounding error. Patches are available in Linux 6.x stable branches and distributed by major Linux vendors.
Affected products
- Linux Linux kernel Multiple versions through 2023-08-24 (fix in upstream commit ac3f9c9f1b37edaa7d1a9b908bc79d843955a1a2)
Timeline
- 2023-08-24: disclosed: Patch commit ac3f9c9f1b37edaa7d1a9b908bc79d843955a1a2 authored by Steve Rutherford
- 2023-09-13: patched: Included in stable kernel releases via commits 6615212d8e131b45bd9705b0d69cc0d2f624666f and others