In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: fix missing sev_decommission in sev_receive_start
DECOMMISSION the current SEV context if binding an ASID fails after RECEIVE_START. Per AMD's SEV API, RECEIVE_START generates a new guest context and thus needs to be paired with DECOMMISSION:
The RECEIVE_START command is the only command other than the LAUNCH_START command that generates a new guest context and guest handle.
The missing DECOMMISSION can result in subsequent SEV launch failures, as the firmware leaks memory and might not able to allocate more SEV guest contexts in the future.
Note, LAUNCH_START suffered the same bug, but was previously fixed by commit 934002cd660b ("KVM: SVM: Call SEV Guest Decommission if ASID binding fails").
CVSS Details
- CVSS 3.1 Base Score: 5.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kselftests-kmp-azureUpgrade kernel-rt-vdsoUpgrade dtb-exynosUpgrade dtb-qcomUpgrade kernel-macrosUpgrade kselftests-kmp-defaultUpgrade kernel-default-optionalUpgrade kernel-rtUpgrade cluster-md-kmp-rtUpgrade kernel-syms-azureUpgrade kernel-rt-optionalUpgrade dtb-amlogicUpgrade gfs2-kmp-azureUpgrade dtb-caviumUpgrade kernel-docsUpgrade kernel-rt_debug-vdsoUpgrade dlm-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade dtb-sprdUpgrade kernel-default-base-rebuildUpgrade kernel-azure-livepatch-develUpgrade kernel-obs-buildUpgrade kernel-azure-vdsoUpgrade dtb-armUpgrade kernel-kvmsmallUpgrade kernel-azure-develUpgrade dlm-kmp-azureUpgrade kernel-rt-develUpgrade kernel-devel-azureUpgrade kernel-sourceUpgrade dtb-mediatekUpgrade kernel-rt-livepatchUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-extraUpgrade dtb-nvidiaUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-64kbUpgrade dtb-rockchipUpgrade kernel-azureUpgrade kernel-64kb-extraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-source-vanillaUpgrade kernel-defaultUpgrade gfs2-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade kernel-default-vdsoUpgrade dtb-broadcomUpgrade kernel-default-livepatch-develUpgrade kernel-develUpgrade dtb-amdUpgrade kernel-source-rtUpgrade kernel-rt_debug-develUpgrade kernel-64kb-livepatch-develUpgrade kselftests-kmp-64kbUpgrade dtb-lgUpgrade dtb-amazonUpgrade kernel-docs-htmlUpgrade dtb-hisiliconUpgrade dtb-renesasUpgrade kernel-default-develUpgrade kernel-64kbUpgrade kernel-symsUpgrade kernel-obs-qaUpgrade dtb-socionextUpgrade kernel-azure-optionalUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-extraUpgrade dtb-xilinxUpgrade dtb-apmUpgrade reiserfs-kmp-64kbUpgrade kernel-debug-develUpgrade kernel-syms-rtUpgrade dlm-kmp-defaultUpgrade kernel-kvmsmall-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade kernel-default-extraUpgrade ocfs2-kmp-64kbUpgrade kernel-source-azureUpgrade ocfs2-kmp-defaultUpgrade dtb-alteraUpgrade dtb-allwinnerUpgrade kernel-debugUpgrade cluster-md-kmp-azureUpgrade dtb-freescaleUpgrade dtb-appleUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-baseUpgrade kernel-devel-rtUpgrade gfs2-kmp-rtUpgrade dtb-marvellUpgrade kernel-64kb-develUpgrade gfs2-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-optionalUpgrade kselftests-kmp-rtUpgrade kernel-rt_debugUpgrade kernel-default-livepatchUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-develUpgrade reiserfs-kmp-rt | Aug 9, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub