Cloudanix VulnDB

CVE-2023-20584

Medium · 5.3

CVSS

5.3

EPSS

0.2%

Published

Aug 13, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A hardware-level flaw in memory protection for secure virtual machines could let a highly privileged attacker quietly tamper with protected guest data.

Chainable
Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
High
Impact
Data Tampering
Component
Firmware
Class
Authorization Bypass
Remediation
Patch
Effort
Medium
Patch risk
Other

What it actually does

The IOMMU fails to correctly validate special address ranges when device table entries are invalid, allowing a privileged attacker with a compromised hypervisor to trigger DTE faults that bypass RMP checks and violate SEV-SNP guest memory integrity protections.

Why it matters to the business

Organizations relying on SEV-SNP for confidential computing face potential integrity violations of virtualized workloads, which could undermine trust in secure enclaves and require additional compensating controls until firmware or hypervisor updates are applied.

How an attack unfolds

An attacker with hypervisor-level access crafts invalid DTEs targeting special address ranges, induces faults through the IOMMU, and bypasses SEV-SNP reverse-map protections to alter or observe guest memory contents without detection.

How to fix it

Apply the latest platform firmware and hypervisor patches that correctly handle special address ranges in the IOMMU; validate SEV-SNP configurations and consider disabling the feature if patches cannot be deployed promptly.

How to confirm the fix worked

Confirm the presence of updated IOMMU microcode and hypervisor binaries that enforce proper DTE validation; test SEV-SNP guest launch and memory integrity checks under fault-injection scenarios.

Typical attack path

  1. Obtain hypervisor privileges on the affected platform
  2. Compromise the hypervisor to control IOMMU configuration
  3. Craft and install invalid device table entries for special address ranges
  4. Trigger DTE faults to bypass SEV-SNP RMP checks
  5. Modify guest memory to compromise integrity

How to detect it

Review hypervisor and IOMMU logs for unexpected DTE fault patterns or invalid device table entries; correlate with SEV-SNP guest integrity violation events in platform event logs.

What your security team should do

  • Prioritize firmware and hypervisor updates for all SEV-SNP-enabled hosts
  • Audit hypervisor privilege boundaries and limit IOMMU access
  • Monitor for any new EPSS or KEV updates given the low current exploit maturity
  • Document compensating controls if immediate patching is not feasible

The record

IOMMU improperly handles certain special address ranges with invalid device table entries (DTEs), which may allow an attacker with privileges and a compromised Hypervisor to induce DTE faults to bypass RMP checks in SEV-SNP, potentially leading to a loss of guest integrity.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 iwl100-firmware 0 39.31.5.1-124.el8_10.1
AlmaLinux:8 iwl1000-firmware 0 1:39.31.5.1-124.el8_10.1
AlmaLinux:8 iwl105-firmware 0 18.168.6.1-124.el8_10.1
AlmaLinux:8 iwl135-firmware 0 18.168.6.1-124.el8_10.1
AlmaLinux:8 iwl2000-firmware 0 18.168.6.1-124.el8_10.1
AlmaLinux:8 iwl2030-firmware 0 18.168.6.1-124.el8_10.1
AlmaLinux:8 iwl3160-firmware 0 1:25.30.13.0-124.el8_10.1
AlmaLinux:8 iwl3945-firmware 0 15.32.2.9-124.el8_10.1
AlmaLinux:8 iwl4965-firmware 0 228.61.2.24-124.el8_10.1
AlmaLinux:8 iwl5000-firmware 0 8.83.5.1_1-124.el8_10.1
AlmaLinux:8 iwl5150-firmware 0 8.24.2.2-124.el8_10.1
AlmaLinux:8 iwl6000-firmware 0 9.221.4.1-124.el8_10.1
AlmaLinux:8 iwl6000g2a-firmware 0 18.168.6.1-124.el8_10.1
AlmaLinux:8 iwl6000g2b-firmware 0 18.168.6.1-124.el8_10.1
AlmaLinux:8 iwl6050-firmware 0 41.28.5.1-124.el8_10.1
AlmaLinux:8 iwl7260-firmware 0 1:25.30.13.0-124.el8_10.1
AlmaLinux:8 libertas-sd8686-firmware 0 20240827-124.git3cff7109.el8_10
AlmaLinux:8 libertas-sd8787-firmware 0 20240827-124.git3cff7109.el8_10
AlmaLinux:8 libertas-usb8388-firmware 0 2:20240827-124.git3cff7109.el8_10
AlmaLinux:8 libertas-usb8388-olpc-firmware 0 20240827-124.git3cff7109.el8_10
AlmaLinux:8 linux-firmware 0 20240827-124.git3cff7109.el8_10
AlmaLinux:9 iwl100-firmware 0 39.31.5.1-143.3.el9_4
AlmaLinux:9 iwl1000-firmware 0 1:39.31.5.1-143.3.el9_4
AlmaLinux:9 iwl105-firmware 0 18.168.6.1-143.3.el9_4
AlmaLinux:9 iwl135-firmware 0 18.168.6.1-143.3.el9_4
AlmaLinux:9 iwl2000-firmware 0 18.168.6.1-143.3.el9_4
AlmaLinux:9 iwl2030-firmware 0 18.168.6.1-143.3.el9_4
AlmaLinux:9 iwl3160-firmware 0 1:25.30.13.0-143.3.el9_4
AlmaLinux:9 iwl5000-firmware 0 8.83.5.1_1-143.3.el9_4
AlmaLinux:9 iwl5150-firmware 0 8.24.2.2-143.3.el9_4
AlmaLinux:9 iwl6000g2a-firmware 0 18.168.6.1-143.3.el9_4
AlmaLinux:9 iwl6000g2b-firmware 0 18.168.6.1-143.3.el9_4
AlmaLinux:9 iwl6050-firmware 0 41.28.5.1-143.3.el9_4
AlmaLinux:9 iwl7260-firmware 0 1:25.30.13.0-143.3.el9_4
AlmaLinux:9 libertas-sd8787-firmware 0 20240905-143.3.el9_4
AlmaLinux:9 linux-firmware 0 20240905-143.3.el9_4
AlmaLinux:9 linux-firmware-whence 0 20240905-143.3.el9_4
AlmaLinux:9 netronome-firmware 0 20240905-143.3.el9_4
Debian:11 amd64-microcode 0 3.20240820.1~deb11u1
Debian:12 amd64-microcode 0 3.20240820.1~deb12u1
Debian:13 amd64-microcode 0 3.20240820.1
Red Hat:enterprise_linux:8::baseos iwl100-firmware 0 0:39.31.5.1-124.el8_10.1
Red Hat:enterprise_linux:8::baseos iwl1000-firmware 0 1:39.31.5.1-124.el8_10.1
Red Hat:enterprise_linux:8::baseos iwl105-firmware 0 0:18.168.6.1-124.el8_10.1
Red Hat:enterprise_linux:8::baseos iwl135-firmware 0 0:18.168.6.1-124.el8_10.1
Red Hat:enterprise_linux:8::baseos iwl2000-firmware 0 0:18.168.6.1-124.el8_10.1
Red Hat:enterprise_linux:8::baseos iwl2030-firmware 0 0:18.168.6.1-124.el8_10.1
Red Hat:enterprise_linux:8::baseos iwl3160-firmware 0 1:25.30.13.0-124.el8_10.1
Red Hat:enterprise_linux:8::baseos iwl3945-firmware 0 0:15.32.2.9-124.el8_10.1
Red Hat:enterprise_linux:8::baseos iwl4965-firmware 0 0:228.61.2.24-124.el8_10.1
Red Hat:enterprise_linux:8::baseos iwl5000-firmware 0 0:8.83.5.1_1-124.el8_10.1
Red Hat:enterprise_linux:8::baseos iwl5150-firmware 0 0:8.24.2.2-124.el8_10.1
Red Hat:enterprise_linux:8::baseos iwl6000-firmware 0 0:9.221.4.1-124.el8_10.1
Red Hat:enterprise_linux:8::baseos iwl6000g2a-firmware 0 0:18.168.6.1-124.el8_10.1
Red Hat:enterprise_linux:8::baseos iwl6000g2b-firmware 0 0:18.168.6.1-124.el8_10.1
Red Hat:enterprise_linux:8::baseos iwl6050-firmware 0 0:41.28.5.1-124.el8_10.1
Red Hat:enterprise_linux:8::baseos iwl7260-firmware 0 1:25.30.13.0-124.el8_10.1
Red Hat:enterprise_linux:8::baseos libertas-sd8686-firmware 0 0:20240827-124.git3cff7109.el8_10
Red Hat:enterprise_linux:8::baseos libertas-sd8787-firmware 0 0:20240827-124.git3cff7109.el8_10
Red Hat:enterprise_linux:8::baseos libertas-usb8388-firmware 0 2:20240827-124.git3cff7109.el8_10
Red Hat:enterprise_linux:8::baseos libertas-usb8388-olpc-firmware 0 0:20240827-124.git3cff7109.el8_10
Red Hat:enterprise_linux:8::baseos linux-firmware 0 0:20240827-124.git3cff7109.el8_10
Red Hat:enterprise_linux:9::baseos iwl100-firmware 0 0:39.31.5.1-143.3.el9_4
Red Hat:enterprise_linux:9::baseos iwl1000-firmware 0 1:39.31.5.1-143.3.el9_4
Red Hat:enterprise_linux:9::baseos iwl105-firmware 0 0:18.168.6.1-143.3.el9_4
Red Hat:enterprise_linux:9::baseos iwl135-firmware 0 0:18.168.6.1-143.3.el9_4
Red Hat:enterprise_linux:9::baseos iwl2000-firmware 0 0:18.168.6.1-143.3.el9_4
Red Hat:enterprise_linux:9::baseos iwl2030-firmware 0 0:18.168.6.1-143.3.el9_4
Red Hat:enterprise_linux:9::baseos iwl3160-firmware 0 1:25.30.13.0-143.3.el9_4
Red Hat:enterprise_linux:9::baseos iwl5000-firmware 0 0:8.83.5.1_1-143.3.el9_4
Red Hat:enterprise_linux:9::baseos iwl5150-firmware 0 0:8.24.2.2-143.3.el9_4
Red Hat:enterprise_linux:9::baseos iwl6000g2a-firmware 0 0:18.168.6.1-143.3.el9_4
Red Hat:enterprise_linux:9::baseos iwl6000g2b-firmware 0 0:18.168.6.1-143.3.el9_4
Red Hat:enterprise_linux:9::baseos iwl6050-firmware 0 0:41.28.5.1-143.3.el9_4
Red Hat:enterprise_linux:9::baseos iwl7260-firmware 0 1:25.30.13.0-143.3.el9_4
Red Hat:enterprise_linux:9::baseos libertas-sd8787-firmware 0 0:20240905-143.3.el9_4
Red Hat:enterprise_linux:9::baseos linux-firmware 0 0:20240905-143.3.el9_4
Red Hat:enterprise_linux:9::baseos linux-firmware-whence 0 0:20240905-143.3.el9_4
Red Hat:enterprise_linux:9::baseos netronome-firmware 0 0:20240905-143.3.el9_4
Red Hat:rhel_aus:8.6::baseos iwl100-firmware 0 0:39.31.5.1-114.3.el8_6.1
Red Hat:rhel_aus:8.6::baseos iwl1000-firmware 0 1:39.31.5.1-114.3.el8_6.1
Red Hat:rhel_aus:8.6::baseos iwl105-firmware 0 0:18.168.6.1-114.3.el8_6.1
Red Hat:rhel_aus:8.6::baseos iwl135-firmware 0 0:18.168.6.1-114.3.el8_6.1
Red Hat:rhel_aus:8.6::baseos iwl2000-firmware 0 0:18.168.6.1-114.3.el8_6.1
Red Hat:rhel_aus:8.6::baseos iwl2030-firmware 0 0:18.168.6.1-114.3.el8_6.1
Red Hat:rhel_aus:8.6::baseos iwl3160-firmware 0 1:25.30.13.0-114.3.el8_6.1
Red Hat:rhel_aus:8.6::baseos iwl3945-firmware 0 0:15.32.2.9-114.3.el8_6.1
Red Hat:rhel_aus:8.6::baseos iwl4965-firmware 0 0:228.61.2.24-114.3.el8_6.1
Red Hat:rhel_aus:8.6::baseos iwl5000-firmware 0 0:8.83.5.1_1-114.3.el8_6.1
Red Hat:rhel_aus:8.6::baseos iwl5150-firmware 0 0:8.24.2.2-114.3.el8_6.1
Red Hat:rhel_aus:8.6::baseos iwl6000-firmware 0 0:9.221.4.1-114.3.el8_6.1
Red Hat:rhel_aus:8.6::baseos iwl6000g2a-firmware 0 0:18.168.6.1-114.3.el8_6.1
Red Hat:rhel_aus:8.6::baseos iwl6000g2b-firmware 0 0:18.168.6.1-114.3.el8_6.1
Red Hat:rhel_aus:8.6::baseos iwl6050-firmware 0 0:41.28.5.1-114.3.el8_6.1
Red Hat:rhel_aus:8.6::baseos iwl7260-firmware 0 1:25.30.13.0-114.3.el8_6.1
Red Hat:rhel_aus:8.6::baseos libertas-sd8686-firmware 0 0:20240827-114.3.git3cff7109.el8_6
Red Hat:rhel_aus:8.6::baseos libertas-sd8787-firmware 0 0:20240827-114.3.git3cff7109.el8_6
Red Hat:rhel_aus:8.6::baseos libertas-usb8388-firmware 0 2:20240827-114.3.git3cff7109.el8_6
Red Hat:rhel_aus:8.6::baseos libertas-usb8388-olpc-firmware 0 0:20240827-114.3.git3cff7109.el8_6
Red Hat:rhel_aus:8.6::baseos linux-firmware 0 0:20240827-114.3.git3cff7109.el8_6
Red Hat:rhel_e4s:8.6::baseos iwl100-firmware 0 0:39.31.5.1-114.3.el8_6.1
Red Hat:rhel_e4s:8.6::baseos iwl1000-firmware 0 1:39.31.5.1-114.3.el8_6.1
Red Hat:rhel_e4s:8.6::baseos iwl105-firmware 0 0:18.168.6.1-114.3.el8_6.1
Red Hat:rhel_e4s:8.6::baseos iwl135-firmware 0 0:18.168.6.1-114.3.el8_6.1
Red Hat:rhel_e4s:8.6::baseos iwl2000-firmware 0 0:18.168.6.1-114.3.el8_6.1
Red Hat:rhel_e4s:8.6::baseos iwl2030-firmware 0 0:18.168.6.1-114.3.el8_6.1
Red Hat:rhel_e4s:8.6::baseos iwl3160-firmware 0 1:25.30.13.0-114.3.el8_6.1
Red Hat:rhel_e4s:8.6::baseos iwl3945-firmware 0 0:15.32.2.9-114.3.el8_6.1
Red Hat:rhel_e4s:8.6::baseos iwl4965-firmware 0 0:228.61.2.24-114.3.el8_6.1
Red Hat:rhel_e4s:8.6::baseos iwl5000-firmware 0 0:8.83.5.1_1-114.3.el8_6.1
Red Hat:rhel_e4s:8.6::baseos iwl5150-firmware 0 0:8.24.2.2-114.3.el8_6.1
Red Hat:rhel_e4s:8.6::baseos iwl6000-firmware 0 0:9.221.4.1-114.3.el8_6.1
Red Hat:rhel_e4s:8.6::baseos iwl6000g2a-firmware 0 0:18.168.6.1-114.3.el8_6.1
Red Hat:rhel_e4s:8.6::baseos iwl6000g2b-firmware 0 0:18.168.6.1-114.3.el8_6.1
Red Hat:rhel_e4s:8.6::baseos iwl6050-firmware 0 0:41.28.5.1-114.3.el8_6.1
Red Hat:rhel_e4s:8.6::baseos iwl7260-firmware 0 1:25.30.13.0-114.3.el8_6.1
Red Hat:rhel_e4s:8.6::baseos libertas-sd8686-firmware 0 0:20240827-114.3.git3cff7109.el8_6
Red Hat:rhel_e4s:8.6::baseos libertas-sd8787-firmware 0 0:20240827-114.3.git3cff7109.el8_6
Red Hat:rhel_e4s:8.6::baseos libertas-usb8388-firmware 0 2:20240827-114.3.git3cff7109.el8_6
Red Hat:rhel_e4s:8.6::baseos libertas-usb8388-olpc-firmware 0 0:20240827-114.3.git3cff7109.el8_6
Red Hat:rhel_e4s:8.6::baseos linux-firmware 0 0:20240827-114.3.git3cff7109.el8_6
Red Hat:rhel_eus:9.2::baseos iwl100-firmware 0 0:39.31.5.1-138.3.el9_2
Red Hat:rhel_eus:9.2::baseos iwl1000-firmware 0 1:39.31.5.1-138.3.el9_2
Red Hat:rhel_eus:9.2::baseos iwl105-firmware 0 0:18.168.6.1-138.3.el9_2
Red Hat:rhel_eus:9.2::baseos iwl135-firmware 0 0:18.168.6.1-138.3.el9_2
Red Hat:rhel_eus:9.2::baseos iwl2000-firmware 0 0:18.168.6.1-138.3.el9_2
Red Hat:rhel_eus:9.2::baseos iwl2030-firmware 0 0:18.168.6.1-138.3.el9_2
Red Hat:rhel_eus:9.2::baseos iwl3160-firmware 0 1:25.30.13.0-138.3.el9_2
Red Hat:rhel_eus:9.2::baseos iwl5000-firmware 0 0:8.83.5.1_1-138.3.el9_2
Red Hat:rhel_eus:9.2::baseos iwl5150-firmware 0 0:8.24.2.2-138.3.el9_2
Red Hat:rhel_eus:9.2::baseos iwl6000g2a-firmware 0 0:18.168.6.1-138.3.el9_2
Red Hat:rhel_eus:9.2::baseos iwl6000g2b-firmware 0 0:18.168.6.1-138.3.el9_2
Red Hat:rhel_eus:9.2::baseos iwl6050-firmware 0 0:41.28.5.1-138.3.el9_2
Red Hat:rhel_eus:9.2::baseos iwl7260-firmware 0 1:25.30.13.0-138.3.el9_2
Red Hat:rhel_eus:9.2::baseos libertas-sd8787-firmware 0 0:20240905-138.3.el9_2
Red Hat:rhel_eus:9.2::baseos linux-firmware 0 0:20240905-138.3.el9_2
Red Hat:rhel_eus:9.2::baseos linux-firmware-whence 0 0:20240905-138.3.el9_2
Red Hat:rhel_eus:9.2::baseos netronome-firmware 0 0:20240905-138.3.el9_2
Red Hat:rhel_tus:8.6::baseos iwl100-firmware 0 0:39.31.5.1-114.3.el8_6.1
Red Hat:rhel_tus:8.6::baseos iwl1000-firmware 0 1:39.31.5.1-114.3.el8_6.1
Red Hat:rhel_tus:8.6::baseos iwl105-firmware 0 0:18.168.6.1-114.3.el8_6.1
Red Hat:rhel_tus:8.6::baseos iwl135-firmware 0 0:18.168.6.1-114.3.el8_6.1
Red Hat:rhel_tus:8.6::baseos iwl2000-firmware 0 0:18.168.6.1-114.3.el8_6.1
Red Hat:rhel_tus:8.6::baseos iwl2030-firmware 0 0:18.168.6.1-114.3.el8_6.1
Red Hat:rhel_tus:8.6::baseos iwl3160-firmware 0 1:25.30.13.0-114.3.el8_6.1
Red Hat:rhel_tus:8.6::baseos iwl3945-firmware 0 0:15.32.2.9-114.3.el8_6.1
Red Hat:rhel_tus:8.6::baseos iwl4965-firmware 0 0:228.61.2.24-114.3.el8_6.1
Red Hat:rhel_tus:8.6::baseos iwl5000-firmware 0 0:8.83.5.1_1-114.3.el8_6.1
Red Hat:rhel_tus:8.6::baseos iwl5150-firmware 0 0:8.24.2.2-114.3.el8_6.1
Red Hat:rhel_tus:8.6::baseos iwl6000-firmware 0 0:9.221.4.1-114.3.el8_6.1
Red Hat:rhel_tus:8.6::baseos iwl6000g2a-firmware 0 0:18.168.6.1-114.3.el8_6.1
Red Hat:rhel_tus:8.6::baseos iwl6000g2b-firmware 0 0:18.168.6.1-114.3.el8_6.1
Red Hat:rhel_tus:8.6::baseos iwl6050-firmware 0 0:41.28.5.1-114.3.el8_6.1
Red Hat:rhel_tus:8.6::baseos iwl7260-firmware 0 1:25.30.13.0-114.3.el8_6.1
Red Hat:rhel_tus:8.6::baseos libertas-sd8686-firmware 0 0:20240827-114.3.git3cff7109.el8_6
Red Hat:rhel_tus:8.6::baseos libertas-sd8787-firmware 0 0:20240827-114.3.git3cff7109.el8_6
Red Hat:rhel_tus:8.6::baseos libertas-usb8388-firmware 0 2:20240827-114.3.git3cff7109.el8_6
Red Hat:rhel_tus:8.6::baseos libertas-usb8388-olpc-firmware 0 0:20240827-114.3.git3cff7109.el8_6
Red Hat:rhel_tus:8.6::baseos linux-firmware 0 0:20240827-114.3.git3cff7109.el8_6
Ubuntu:20.04:LTS amd64-microcode 0 No fix
Ubuntu:22.04:LTS amd64-microcode 0 No fix
Ubuntu:24.04:LTS amd64-microcode 0 No fix
Ubuntu:24.04:LTS amd64-microcode 0 3.20250311.1ubuntu0.24.04.1
Ubuntu:24.10 amd64-microcode 0 No fix
Ubuntu:Pro:14.04:LTS amd64-microcode 0 No fix
Ubuntu:Pro:16.04:LTS amd64-microcode 0 No fix
Ubuntu:Pro:18.04:LTS amd64-microcode 0 No fix

Related vulnerabilities