CVE-2023-52659

What it actually does

The pfn_to_kaddr() macro on 64-bit x86 loses high-order address bits when a 40-bit GFN field is passed directly, because the input is not widened to 64 bits before the PAGE_SHIFT operation, producing incorrect virtual mappings for physical addresses above 1 TB.

Why it matters to the business

SEV-SNP confidential VMs can crash when memory regions above 1 TB are validated, reducing availability of secure virtualization workloads on affected kernels.

How an attack unfolds

An attacker controlling a SEV-SNP guest triggers repeated page-state-change requests that supply GFNs larger than 1 TB; the truncated address calculation produces an invalid mapping and the guest faults.

How to fix it

Upgrade the Linux kernel to commit 325956b0173f11e98f90462be4829a8b8b0682ce or later; rebuild and reboot all affected hosts. No configuration workaround exists.

How to confirm the fix worked

Confirm the running kernel contains the inline-function version of pfn_to_kaddr(); attempt to map a GFN > 1 TB inside an SEV-SNP guest and verify the guest remains stable.

Typical attack path

1. Obtain code execution or control inside an SEV-SNP guest
2. Issue page-state-change hypercalls referencing GFNs above the 1 TB boundary
3. Trigger the pfn_to_kaddr() macro with the narrow 40-bit field
4. Observe guest crash due to invalid virtual address

How to detect it

Review guest kernel logs for unexpected page-faults or crashes during memory validation operations on SEV-SNP systems; correlate with hypervisor page-state-change activity.

What your security team should do

• Prioritize kernel updates on all SEV-SNP hosts within normal change windows
• Monitor EPSS and KEV status for any future rise in exploit activity
• Include the fixed commit hash in automated kernel-build pipelines