Linux Kernel KVM SEV Page State Change Buffer Validation Vulnerability

A vulnerability in the Linux kernel's KVM SEV (Secure Encrypted Virtualization) implementation has been addressed. This issue involved improper validation of Page State Change (PSC) request indices against the actual size of the buffer. When processing PSC requests, the kernel did not adequately check the PSC buffer against the effective size of the scratch area, which could be smaller than expected if the guest provided a pointer that was not aligned with the beginning of the GHCB (Guest Hypervisor Communication Block) shared buffer. This flaw could potentially lead to buffer-related errors or vulnerabilities.

Impact

The vulnerability could cause incorrect handling of Page State Change requests, potentially leading to buffer overflows or other memory-related issues.

Reproduction

To reproduce this vulnerability, a guest VM must be configured to use SEV and provide a misaligned pointer to the GHCB shared buffer when issuing Page State Change requests. This misalignment can cause the PSC buffer validation to fail, allowing for improper handling of the request.

Remediation

Users can upgrade to the latest stable version of the Linux kernel, where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.