New Security Vulnerabilities Found Affecting AMD EPYC Processors

Summary

AMD is aware of 2 research papers related to AMD’s Secure Encrypted Virtualization (SEV) which will be presented at this year’s 15th IEEE Workshop on Offensive Technologies (WOOT’21).

In the paper titled “SEVerity:  Code Injection Attacks against Encrypted Virtual Machines,” researchers from Fraunhofer AISEC, in partnership with Technical University of Munich, make use of previously discussed research around the lack of nested page table protection in the SEV/SEV-ES feature which could potentially lead to arbitrary code execution within the guest.

In the paper titled “undeSErVed trust: Exploiting Permutation-Agnostic Remote Attestation,” researchers from University of Lubeck demonstrate that in the SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a malicious hypervisor to potentially lead to arbitrary code execution within the guest.

The exploits mentioned in both papers require a malicious administrator to have access in order to compromise the server hypervisor.

Affected Products

• 1^st/2^nd/3^rd Gen AMD EPYC™ Processors
• AMD EPYC™ Embedded Processors

Mitigation

AMD has provided mitigation in the SEV-SNP feature which is available for enablement in 3^rd Gen AMD EPYC™ processors.

The mitigation requires the use of SEV-SNP, which is only supported on 3rd Gen AMD EPYC™.

Prior generations of AMD EPYC™ do not support SEV-SNP.  For earlier AMD EPYC™ products, AMD recommends following security best practices.

For additional information on SEV-SNP and SEV/SEV-ES please refer to our white paper in the References Section of this document.

Acknowledgement

AMD thanks the following for reporting these issues and engaging in coordinated vulnerability disclosure.

• CVE-2020-12967:  Mathias Morbitzer, Martin Radev and Erick Quintanar Salas from Fraunhofer AISEC and Sergej Proskurin and Marko Dorfhuber from Technical University of Munich
• CVE-2021-26311: Luca Wilke, Jan Wichelmann, Florian Sieck and Thomas Eisenbarth from University of Lübeck

Source: AMD Security