CVE-2023-4155

What it actually does

A double-fetch race condition in the KVM AMD SEV VMGEXIT handler allows a guest with multiple vCPUs running SEV-ES or SEV-SNP to invoke the handler recursively, causing a stack overflow that leads to denial of service or guest-to-host escape when CONFIG_VMAP_STACK is disabled.

Why it matters to the business

Virtualized workloads on affected AMD SEV hosts may experience sudden crashes or loss of isolation between guest and host, increasing operational downtime and risking compromise of the underlying hypervisor in configurations lacking stack protection.

How an attack unfolds

An attacker controlling a guest VM issues concurrent VMGEXIT calls from multiple vCPUs to trigger the race, recursively invoking the handler until the stack overflows and control flow is hijacked or the kernel panics.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the double-fetch race in the SEV VMGEXIT path; enable CONFIG_VMAP_STACK on all affected hosts; apply vendor updates for Red Hat Enterprise Linux and Fedora as they become available.

How to confirm the fix worked

Verify the presence of the upstream patch in the running kernel, confirm CONFIG_VMAP_STACK=y via kernel config inspection, and test that SEV-ES/SNP guests with multiple vCPUs no longer trigger recursive VMGEXIT behavior under load.

Typical attack path

1. Gain code execution or control inside a KVM guest using SEV-ES or SEV-SNP with multiple vCPUs
2. Issue concurrent VMGEXIT hypercalls from separate vCPUs to induce the double-fetch race
3. Recursively trigger the handler to exhaust the stack
4. Either crash the host kernel (DoS) or attempt control-flow hijack for guest-to-host escape if stack guards are absent

How to detect it

Inspect kernel logs for repeated VMGEXIT entries, stack overflow oops, or SEV handler recursion; correlate with guest activity showing high-frequency hypercalls from multiple vCPUs.

What your security team should do

• Prioritize kernel updates on all AMD SEV hosts within the next maintenance window
• Audit virtualization configurations for disabled stack guard pages and enable CONFIG_VMAP_STACK where missing
• Monitor for kernel oops or panic messages referencing VMGEXIT or SEV handlers
• Restrict creation of multi-vCPU SEV-ES/SNP guests until patches are deployed