The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
In the Linux kernel, the following vulnerability has been resolved:
x86/ioremap: Map EFI-reserved memory as encrypted for SEV
Some drivers require memory that is marked as EFI boot services data. In order for this memory to not be re-used by the kernel after ExitBootServices(), efi_mem_reserve() is used to preserve it by inserting a new EFI memory descriptor and marking it with the EFI_MEMORY_RUNTIME attribute.
Under SEV, memory marked with the EFI_MEMORY_RUNTIME attribute needs to be mapped encrypted by Linux, otherwise the kernel might crash at boot like below:
EFI Variables Facility v0.08 2004-May-17 general protection fault, probably for non-canonical address 0x3597688770a868b2: 0000 [#1] SMP NOPTI CPU: 13 PID: 1 Comm: swapper/0 Not tainted 5.12.4-2-default #1 openSUSE Tumbleweed Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:efi_mokvar_entry_next [...] Call Trace: efi_mokvar_sysfs_init ? efi_mokvar_table_init do_one_initcall ? __kmalloc kernel_init_freeable ? rest_init kernel_init ret_from_fork
Expand the __ioremap_check_other() function to additionally check for this other type of boot data reserved at runtime and indicate that it should be mapped encrypted for an SEV guest.
[ bp: Massage commit message. ]
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade perf-debuginfoUpgrade perfUpgrade kernel-develUpgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf-debuginfoUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade python-perf | May 22, 2025 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-obs-buildUpgrade kernel-preemptUpgrade kernel-sourceUpgrade reiserfs-kmp-defaultUpgrade kernel-preempt-develUpgrade kernel-develUpgrade kernel-64kbUpgrade kernel-default-develUpgrade kernel-docsUpgrade kernel-zfcpdumpUpgrade kernel-64kb-develUpgrade kernel-defaultUpgrade kernel-macrosUpgrade kernel-default-baseUpgrade kernel-syms | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-bluefieldUpgrade linux-gcpUpgrade linux-ibm-5.4Upgrade linuxUpgrade linux-azureUpgrade linux-raspi-5.4Upgrade linux-azure-5.4Upgrade linux-awsUpgrade linux-fipsUpgrade linux-kvmUpgrade linux-hwe-5.4Upgrade linux-gcp-5.4Upgrade linux-gkeopUpgrade linux-oracle-5.4Upgrade linux-aws-5.4Upgrade linux-ibmUpgrade linux-raspiUpgrade linux-oracle | Nov 19, 2024 | May 21, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub