Linux Kernel KVM SVM Page Overflow Vulnerability in SEV Debug Crypt Function

A vulnerability in the Linux kernel's KVM SVM module has been identified, specifically within the SEV debugging cryptography functions. The issue arises because the transfer length for each iteration is limited by the source page offset but not by the destination page offset. This oversight can lead to a page overflow when certain conditions are met, allowing the PSP (Platform Security Processor) to write beyond the allocated buffer, causing a use-after-free error. The vulnerability can be triggered by manipulating the offsets and the length of the data being processed, particularly in the encryption path of the SEV debug commands.

Impact

Exploitation of this vulnerability causes a use-after-free error, which can lead to memory corruption.

Reproduction

The vulnerability can be reproduced by sending a SEV DEBUG_ENCRYPT command through the KVM interface, with the destination offset set to 1 and the length set to the page size minus the offset. This combination causes the PSP to write more data than the allocated buffer can handle, creating an overflow.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.