USN-8887-1: Linux kernel flaws, one compromising SEV-SNP guest integrity

Ubuntu has published security advisory USN-8887-1, which fixes multiple vulnerabilities in the Linux kernel. It is relevant to anyone managing virtualisation hosts and VPS on AMD infrastructure with SEV-SNP, as well as those running ARM64 or ARM32 systems in production.

The most critical flaw: CVE-2023-20585

According to the official Ubuntu advisory, certain AMD processors did not correctly perform Reverse Map Table (RMP) checks when the IOMMU accessed specific host buffers. A local attacker with hypervisor access could exploit this flaw to trigger an out-of-bounds condition and compromise the memory integrity of SEV-SNP guests.

For anyone offering VPS or private cloud services based on AMD SEV-SNP confidential computing technology, this is not a point to underestimate: the promise of guest isolation from the hypervisor is precisely what this class of vulnerability calls into question.

Other components fixed

The advisory also flags further security issues in the Linux kernel, in the following subsystems:

• ARM64 architecture;
• NVDIMM (Non-Volatile Memory Device) driver;
• Handshake API;
• ARM32 architecture.

The text of the official advisory, in the portion available, does not provide full details of all the CVEs associated with these subsystems, nor a list of the affected kernel packages (linux-generic, linux-aws, linux-azure and variants). Anyone managing Ubuntu servers should check the official advisory page at ubuntu.com/security/notices/USN-8887-1 for the complete list of packages to update and to check whether a reboot is required, as is often the case with kernel updates.

What to do

As with any kernel-related USN, the update is applied with:

sudo apt update && sudo apt upgrade

followed, if required by the package changelog, by a system reboot to load the new kernel into memory. For virtualisation hosts running SEV-SNP guests, also check the AMD SEV-SNP firmware version via the platform vendor's documentation, since the kernel-side mitigation alone may not cover the entire attack chain described in the CVE.