Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2023-4155: Linux kernel AMD VM encryption may crash host
CVE-2023-4155 · published 3 years ago
Summary
Linux servers that use AMD’s encrypted virtual machines can be forced to run a special routine many times at once. This can overflow the system’s memory, which may crash the server or, in rare cases, allow code from the virtual machine to affect the host operating system. Install the latest Linux kernel updates and keep the virtualization platform patched, and enable the default memory‑safety options.
What to do
- Update canonical linux-aws-5.15 to version 5.15.0-1047.52~20.04.1.
- Update canonical linux-azure-5.15 to version 5.15.0-1049.56~20.04.1.
- Update canonical linux-gcp-5.15 to version 5.15.0-1044.52~20.04.1.
- Update canonical linux-gkeop-5.15 to version 5.15.0-1030.35~20.04.1.
- Update canonical linux-hwe-5.15 to version 5.15.0-86.96~20.04.1.
- Update canonical linux-ibm-5.15 to version 5.15.0-1040.43~20.04.1.
- Update canonical linux-intel-iotg-5.15 to version 5.15.0-1043.49~20.04.1.
- Update canonical linux-lowlatency-hwe-5.15 to version 5.15.0-86.95~20.04.1.
- Update canonical linux-nvidia-tegra-5.15 to version 5.15.0-1018.18~20.04.1.
- Update canonical linux-oracle-5.15 to version 5.15.0-1045.51~20.04.1.
- Update canonical linux-riscv-5.15 to version 5.15.0-1043.47~20.04.1.
- Update canonical linux to version 5.15.0-86.96.
- Update canonical linux-aws to version 5.15.0-1047.52.
- Update canonical linux-aws-6.2 to version 6.2.0-1013.13~22.04.1.
- Update canonical linux-azure to version 5.15.0-1049.56.
- Update canonical linux-azure-6.2 to version 6.2.0-1014.14~22.04.1.
- Update canonical linux-azure-fde to version 5.15.0-1049.56.1.
- Update canonical linux-azure-fde-6.2 to version 6.2.0-1014.14~22.04.1.1.
- Update canonical linux-gcp to version 5.15.0-1044.52.
- Update canonical linux-gcp-6.2 to version 6.2.0-1016.18~22.04.1.
- Update canonical linux-gke to version 5.15.0-1044.49.
- Update canonical linux-gkeop to version 5.15.0-1030.35.
- Update canonical linux-hwe-6.2 to version 6.2.0-34.34~22.04.1.
- Update canonical linux-ibm to version 5.15.0-1040.43.
- Update canonical linux-intel-iotg to version 5.15.0-1043.49.
- Update canonical linux-kvm to version 5.15.0-1044.49.
- Update canonical linux-lowlatency to version 5.15.0-86.95.
- Update canonical linux-lowlatency-hwe-6.2 to version 6.2.0-1014.14~22.04.1.
- Update canonical linux-nvidia to version 5.15.0-1037.37.
- Update canonical linux-nvidia-6.2 to version 6.2.0-1011.11.
- Update canonical linux-nvidia-tegra to version 5.15.0-1018.18.
- Update canonical linux-nvidia-tegra-igx to version 5.15.0-1005.5.
- Update canonical linux-oem-6.1 to version 6.1.0-1021.21.
- Update canonical linux-oracle to version 5.15.0-1045.51.
- Update canonical linux-raspi to version 5.15.0-1040.43.
- Update canonical linux-xilinx-zynqmp to version 5.15.0-1025.29.
- Update canonical linux-bluefield to version 5.15.0-1027.29.
- Update canonical linux-intel-iot-realtime to version 5.15.0-1040.42.
- Update canonical linux-realtime to version 5.15.0-1048.54.
- Update debian linux to version 6.1.52-1.
- Update debian linux to version 6.4.11-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gkeop-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oem | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.15 |
< 5.15.0-1047.52~20.04.1 Fix: upgrade to 5.15.0-1047.52~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-azure-5.15 |
< 5.15.0-1049.56~20.04.1 Fix: upgrade to 5.15.0-1049.56~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.15 |
< 5.15.0-1044.52~20.04.1 Fix: upgrade to 5.15.0-1044.52~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-gkeop-5.15 |
< 5.15.0-1030.35~20.04.1 Fix: upgrade to 5.15.0-1030.35~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.15 |
< 5.15.0-86.96~20.04.1 Fix: upgrade to 5.15.0-86.96~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-ibm-5.15 |
< 5.15.0-1040.43~20.04.1 Fix: upgrade to 5.15.0-1040.43~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-intel-iotg-5.15 |
< 5.15.0-1043.49~20.04.1 Fix: upgrade to 5.15.0-1043.49~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-lowlatency-hwe-5.15 |
< 5.15.0-86.95~20.04.1 Fix: upgrade to 5.15.0-86.95~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-nvidia-tegra-5.15 |
< 5.15.0-1018.18~20.04.1 Fix: upgrade to 5.15.0-1018.18~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.15 |
< 5.15.0-1045.51~20.04.1 Fix: upgrade to 5.15.0-1045.51~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.15 |
< 5.15.0-1043.47~20.04.1 Fix: upgrade to 5.15.0-1043.47~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-aws-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-intel-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.10 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.14 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.6 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
Showing 50 of 100. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux |
< 5.15.0-86.96 Fix: upgrade to 5.15.0-86.96
|
| Ubuntu:22.04:LTS | canonical | linux-allwinner-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws |
< 5.15.0-1047.52 Fix: upgrade to 5.15.0-1047.52
|
| Ubuntu:22.04:LTS | canonical | linux-aws-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.2 |
< 6.2.0-1013.13~22.04.1 Fix: upgrade to 6.2.0-1013.13~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-azure |
< 5.15.0-1049.56 Fix: upgrade to 5.15.0-1049.56
|
| Ubuntu:22.04:LTS | canonical | linux-azure-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.2 |
< 6.2.0-1014.14~22.04.1 Fix: upgrade to 6.2.0-1014.14~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-azure-fde |
< 5.15.0-1049.56.1 Fix: upgrade to 5.15.0-1049.56.1
|
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.2 |
< 6.2.0-1014.14~22.04.1.1 Fix: upgrade to 6.2.0-1014.14~22.04.1.1
|
| Ubuntu:22.04:LTS | canonical | linux-gcp |
< 5.15.0-1044.52 Fix: upgrade to 5.15.0-1044.52
|
| Ubuntu:22.04:LTS | canonical | linux-gcp-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.2 |
< 6.2.0-1016.18~22.04.1 Fix: upgrade to 6.2.0-1016.18~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-gke |
< 5.15.0-1044.49 Fix: upgrade to 5.15.0-1044.49
|
| Ubuntu:22.04:LTS | canonical | linux-gkeop |
< 5.15.0-1030.35 Fix: upgrade to 5.15.0-1030.35
|
| Ubuntu:22.04:LTS | canonical | linux-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.2 |
< 6.2.0-34.34~22.04.1 Fix: upgrade to 6.2.0-34.34~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-ibm |
< 5.15.0-1040.43 Fix: upgrade to 5.15.0-1040.43
|
| Ubuntu:22.04:LTS | canonical | linux-intel-iotg |
< 5.15.0-1043.49 Fix: upgrade to 5.15.0-1043.49
|
| Ubuntu:22.04:LTS | canonical | linux-kvm |
< 5.15.0-1044.49 Fix: upgrade to 5.15.0-1044.49
|
| Ubuntu:22.04:LTS | canonical | linux-lowlatency |
< 5.15.0-86.95 Fix: upgrade to 5.15.0-86.95
|
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.2 |
< 6.2.0-1014.14~22.04.1 Fix: upgrade to 6.2.0-1014.14~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia |
< 5.15.0-1037.37 Fix: upgrade to 5.15.0-1037.37
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.2 |
< 6.2.0-1011.11 Fix: upgrade to 6.2.0-1011.11
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia-tegra |
< 5.15.0-1018.18 Fix: upgrade to 5.15.0-1018.18
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia-tegra-igx |
< 5.15.0-1005.5 Fix: upgrade to 5.15.0-1005.5
|
| Ubuntu:22.04:LTS | canonical | linux-oem-5.17 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.0 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.1 |
< 6.1.0-1021.21 Fix: upgrade to 6.1.0-1021.21
|
| Ubuntu:22.04:LTS | canonical | linux-oracle |
< 5.15.0-1045.51 Fix: upgrade to 5.15.0-1045.51
|
| Ubuntu:22.04:LTS | canonical | linux-raspi |
< 5.15.0-1040.43 Fix: upgrade to 5.15.0-1040.43
|
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-xilinx-zynqmp |
< 5.15.0-1025.29 Fix: upgrade to 5.15.0-1025.29
|
| Ubuntu:Nvidia-BlueField:22.04:LTS | canonical | linux-bluefield |
< 5.15.0-1027.29 Fix: upgrade to 5.15.0-1027.29
|
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-intel-iot-realtime |
< 5.15.0-1040.42 Fix: upgrade to 5.15.0-1040.42
|
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-realtime |
< 5.15.0-1048.54 Fix: upgrade to 5.15.0-1048.54
|
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Debian:12 | debian | linux |
< 6.1.52-1 Fix: upgrade to 6.1.52-1
|
| Debian:13 | debian | linux |
< 6.4.11-1 Fix: upgrade to 6.4.11-1
|
| – | linux | linux_kernel |
All versions
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux |
8.0 9.0 cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
37 38 cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* |
Original advisory text
A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerabilit...
A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the `VMGEXIT` handler recursively. If an attacker manages to call the handler multiple times, they can trigger a stack overflow and cause a denial of service or potentially guest-to-host escape in kernel configurations without stack guard pages (`CONFIG_VMAP_STACK`).
References
- https://ubuntu.com/security/CVE-2023-4155 Third Party Advisory
- https://git.kernel.org/linus/7588dbcebcbf0193ab5b76987396d0254270b04a Third Party Advisory
- https://patchew.org/linux/[email protected]/ Third Party Advisory
- https://ubuntu.com/security/notices/USN-6343-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-6412-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-6416-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-6416-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-6416-3 Vendor Advisory
- https://ubuntu.com/security/notices/USN-6445-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-6445-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-6466-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-4155 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2023-4155 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-4155 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2213802 Issue Tracking Patch Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition
Timeline
Published13 Sep 2023
Updated26 Oct 2026
First seen9 Sep 2026
Track software like this
Free during beta