Bug 1223307 (CVE-2024-25743) - VUL-0: CVE-2024-25743: kernel: insufficient validation during #VC instruction emulation
Summary: VUL-0: CVE-2024-25743: kernel: insufficient validation during #VC instruction...
Status: RESOLVED WONTFIX
Alias: CVE-2024-25743
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P2 - High : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/398287/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-25743:7.1:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-23 12:57 UTC by Marcus Meissner
Modified: 2024-07-09 10:17 UTC (History)
14 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2024-04-23 12:57:28 UTC 
+++ This bug was initially created as a clone of Bug #1221725 +++

+++ This bug was initially created as a clone of Bug #1221638 +++

Fixes CVE-2024-25743 

Not yet fixed so far.
Comment 1 Marcus Meissner 2024-04-23 13:07:38 UTC 
according to AMD Borislav it is still WIP in development.
Comment 11 Joerg Roedel 2024-06-18 13:22:24 UTC 
This CVE is affecting scenarios when the hypervisor can attack its guests. This is security relevant only in setups where HV is not trusted and as such this would be only problematic in Confidential VMs. This is not a scenario we do support on the host side yet.

Affected hypervisor setups used at CSPs do not offer the AMD SEV-SNP Restricted Injection feature required to fix this issue, nor is any fix available in the upstream Linux kernel.
Comment 13 Thomas Leroy 2024-07-09 10:17:23 UTC 
(In reply to Joerg Roedel from comment #11)
> This CVE is affecting scenarios when the hypervisor can attack its guests.
> This is security relevant only in setups where HV is not trusted and as such
> this would be only problematic in Confidential VMs. This is not a scenario
> we do support on the host side yet.
> 
> Affected hypervisor setups used at CSPs do not offer the AMD SEV-SNP
> Restricted Injection feature required to fix this issue, nor is any fix
> available in the upstream Linux kernel.

Thanks for the explanations Jörg. This makes sense to me for WONTFIX. Closing