CVE-2023-53996

What it actually does

The enc_dec_hypercall() function accepted a page count instead of a byte size, forcing callers to round up and causing non-page-aligned vaddrs to spuriously mark additional pages as decrypted via the encryption status hypercall, resulting in consistent page corruption during live migration of SEV guests.

Why it matters to the business

Live migration of encrypted virtual machines may fail or corrupt guest memory, disrupting high-availability operations and requiring fallback to cold migration or reboots on systems using AMD SEV.

How an attack unfolds

An attacker does not actively exploit this flaw; instead, normal live-migration operations on affected kernels trigger the rounding error, causing the hypervisor to present an incorrect encryption bitmap that leads to data corruption from the guest's perspective.

How to fix it

Update to a kernel containing commit ee642f973a7c95d2d146fe03c81bcdee1871f4ec (or equivalent) that changes enc_dec_hypercall() to accept a size parameter; rebuild and deploy the fixed kernel on all SEV-enabled hosts.

How to confirm the fix worked

Confirm the presence of the size-accepting version of enc_dec_hypercall() in the running kernel source or binary and verify that live migration of an SEV VM with non-page-aligned memory regions completes without guest memory corruption.

Typical attack path

1. Initiate live migration of an SEV-protected VM
2. Kernel rounds non-page-aligned vaddr to the next page boundary
3. Encryption status hypercall marks extra pages as decrypted
4. Migration proceeds with incorrect encryption state
5. Guest pages become corrupted after migration completes

How to detect it

Review live-migration logs for reports of encryption status mismatches or unexpected page decryption events; examine dmesg and hypervisor logs around migration timestamps for evidence of spurious decryption marking.

What your security team should do

• Prioritize patching SEV-enabled hosts within standard change windows
• Test live migration thoroughly after applying the fix
• Monitor vendor advisories for backports to supported LTS kernels