CVE-2023-54296

What it actually does

KVM incorrectly retrieves source vCPUs from the destination VM during intrahost SEV-ES migration, leaving a NULL VMSA pointer that triggers a page fault and host kernel crash in __free_pages when vCPUs are later freed.

Why it matters to the business

Host systems running affected Linux kernels can crash during virtual machine migrations involving SEV-ES protected guests, causing unplanned downtime for all workloads on the hypervisor and potential loss of in-flight VM state.

How an attack unfolds

An attacker with the ability to initiate or influence an intrahost migration of a SEV-ES VM triggers the misdirected vCPU lookup in kvm_amd, resulting in the NULL pointer dereference and immediate host kernel panic.

How to fix it

Upgrade to a kernel containing commit 5c18ace750e4d4d58d7da02d1c669bf21c824158. For the linux (Echo) package apply the fix released in version 1. Reboot hosts after the update and verify migration functionality with SEV-ES guests.

How to confirm the fix worked

Confirm the presence of commit 5c18ace750e4d4d58d7da02d1c669bf21c824158 in the running kernel source or package changelog. Perform test intrahost migrations of SEV-ES VMs and monitor for absence of the previously observed page fault and NULL VMSA oops.

Typical attack path

1. Initiate intrahost migration for a SEV-ES protected VM
2. KVM SVM code fetches vCPU objects from the destination VM instead of the source
3. VMSA pointer remains NULL after migration setup
4. sev_free_vcpu and subsequent kvm cleanup paths dereference the invalid pointer
5. Host kernel panics with page fault in __free_pages

How to detect it

Search kernel logs and crash dumps for oops messages containing sev_migrate_tes, sev_free_vcpu, svm_vcpu_free, or page faults referencing ffffe38687000000 together with kvm_amd module activity.

• sev_migrate_tes
• BUG: unable to handle page fault for address: ffffe38687000000
• __free_pages+0x15/0xd0
• sev_free_vcpu+0xcb/0x110 [kvm_amd]
• CR2: ffffe38687000000

What your security team should do

• Prioritize patching all hypervisor hosts that support SEV-ES VMs
• Temporarily restrict intrahost migrations for SEV-ES guests until patches are applied
• Enable kernel crash dumping and central log collection to capture any residual incidents
• Review downstream package update policies to reduce time-to-fix for future kernel CVEs