CVE-2023-46813

What it actually does

Local userspace process with MMIO register access can exploit a race in the SEV-ES #VC handler and MMIO instruction emulation to perform an arbitrary kernel memory write, achieving privilege escalation.

Why it matters to the business

Attackers on affected Linux systems can gain full root access, allowing them to steal data, install persistent malware, or disrupt operations; the issue affects many distributions but has seen no known exploitation after more than two years.

How an attack unfolds

A local attacker maps MMIO registers, triggers an SEV-ES #VC exception via a crafted instruction, then races to swap the instruction in userspace memory before the handler reads it, causing the emulation logic to write attacker-controlled data into kernel memory.

How to fix it

Upgrade the Linux kernel to a version containing commit 63e44bc52047f182601e7817da969a105aa1f721 (equivalent to 6.5.9 or later distribution backports); apply vendor kernel updates immediately and verify the running kernel version after reboot.

How to confirm the fix worked

Run 'uname -r' and confirm the kernel is at or above 6.5.9; review distribution security advisories for backported fixes; test that SEV-ES MMIO paths no longer permit the described race by using kernel selftests or vendor-provided validation tools.

Typical attack path

1. Obtain local shell or process execution on a vulnerable Linux kernel with SEV-ES enabled
2. Map memory-mapped I/O registers accessible from userspace
3. Trigger a #VC exception with a specific instruction sequence
4. Race-replace the instruction bytes before the handler fetches them
5. Leverage resulting arbitrary kernel write to overwrite credentials or function pointers
6. Escalate to root and execute post-exploitation actions

How to detect it

Search kernel audit logs and dmesg for unexpected #VC handler activity or SEV-ES MMIO emulation errors around the time of suspected privilege-escalation events; correlate with unusual process credential changes or new root-owned processes started by non-root users.

What your security team should do

• Prioritize kernel updates on all systems exposing SEV-ES or AMD SEV features
• Harden local access controls and limit users who can map MMIO devices
• Monitor vendor mailing lists for additional backports to older LTS kernels
• Reboot systems after kernel package installation to load the fixed binary