CVE-2023-4155

CVSS 3.1 Score 5.3 of 10 (medium)

Details

Published Sep 13, 2023
Updated: Nov 7, 2023
CWE ID 367

Summary

CVE-2023-4155 is a vulnerability found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. It affects KVM guests using SEV-ES or SEV-SNP with multiple vCPUs. The vulnerability allows an attacker to trigger a double fetch race condition, leading to the recursive invocation of the `VMGEXIT` handler. If exploited successfully, this can result in a stack overflow and cause a denial of service or potentially enable guest-to-host escape in kernel configurations without stack guard pages (`CONFIG_VMAP_STACK`). The vulnerability has a base severity of MEDIUM with a CVSS score of 5.3 and requires high privileges to be exploited. To mitigate this vulnerability, users should apply relevant patches and updates provided by their respective vendors.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-4155 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options