In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: fix missing sev_decommission in sev_receive_start
DECOMMISSION the current SEV context if binding an ASID fails after RECEIVE_START. Per AMD's SEV API, RECEIVE_START generates a new guest context and thus needs to be paired with DECOMMISSION:
The RECEIVE_START command is the only command other than the LAUNCH_START command that generates a new guest context and guest handle.
The missing DECOMMISSION can result in subsequent SEV launch failures, as the firmware leaks memory and might not able to allocate more SEV guest contexts in the future.
Note, LAUNCH_START suffered the same bug, but was previously fixed by commit 934002cd660b ("KVM: SVM: Call SEV Guest Decommission if ASID binding fails").
CVSS Details
- CVSS 3.1 Base Score: 5.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade dtb-broadcomUpgrade kernel-docs-htmlUpgrade kernel-debug-develUpgrade dtb-amazonUpgrade dtb-xilinxUpgrade kernel-64kb-livepatch-develUpgrade dtb-lgUpgrade kernel-debugUpgrade dtb-allwinnerUpgrade kernel-rt_debug-develUpgrade kernel-rt_debugUpgrade dtb-renesasUpgrade reiserfs-kmp-rtUpgrade kernel-source-rtUpgrade kernel-default-livepatchUpgrade kernel-rt_debug-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade kernel-default-develUpgrade kernel-kvmsmall-livepatch-develUpgrade dlm-kmp-defaultUpgrade dtb-hisiliconUpgrade dtb-apmUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-rtUpgrade dlm-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade kernel-default-baseUpgrade kernel-default-extraUpgrade kernel-64kb-develUpgrade kernel-kvmsmall-develUpgrade kernel-zfcpdumpUpgrade reiserfs-kmp-defaultUpgrade kernel-devel-rtUpgrade dtb-socionextUpgrade gfs2-kmp-rtUpgrade kernel-azure-extraUpgrade kernel-syms-rtUpgrade kernel-obs-qaUpgrade dtb-appleUpgrade ocfs2-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade kernel-develUpgrade kernel-azure-optionalUpgrade reiserfs-kmp-64kbUpgrade kernel-symsUpgrade dtb-freescaleUpgrade kernel-64kb-optionalUpgrade dtb-amdUpgrade gfs2-kmp-64kbUpgrade dtb-alteraUpgrade kselftests-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade kernel-source-azureUpgrade kernel-64kbUpgrade dtb-marvellUpgrade kernel-azure-develUpgrade dtb-nvidiaUpgrade cluster-md-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-debug-vdsoUpgrade kernel-azure-livepatch-develUpgrade kernel-rt-livepatch-develUpgrade dtb-armUpgrade dtb-sprdUpgrade kernel-rt-vdsoUpgrade kernel-sourceUpgrade kernel-kvmsmallUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-livepatchUpgrade kernel-azure-vdsoUpgrade kernel-source-vanillaUpgrade dtb-exynosUpgrade dtb-mediatekUpgrade dlm-kmp-azureUpgrade dtb-qcomUpgrade cluster-md-kmp-64kbUpgrade kernel-macrosUpgrade kernel-rt-develUpgrade kernel-rt-extraUpgrade kernel-devel-azureUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade kselftests-kmp-defaultUpgrade kernel-default-base-rebuildUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-vdsoUpgrade kernel-defaultUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-azureUpgrade dtb-rockchipUpgrade kernel-azureUpgrade dlm-kmp-rtUpgrade kernel-docsUpgrade kernel-obs-buildUpgrade dtb-caviumUpgrade dtb-amlogicUpgrade gfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-default-optionalUpgrade kernel-rt | Aug 9, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub