CVE-2024-25742

What it actually does

An untrusted hypervisor can inject virtual interrupt 29 (#VC) at arbitrary times and trigger its handler in the Linux kernel, affecting AMD SEV-SNP and SEV-ES confidential computing features.

Why it matters to the business

Organizations running AMD SEV-protected virtual machines face risk of unauthorized interference with secure execution environments, which can lead to exposure of sensitive workloads or reduced trust in virtualized infrastructure.

How an attack unfolds

An attacker controlling the hypervisor injects the #VC interrupt into a guest running on AMD SEV-ES or SEV-SNP, causing the kernel handler to execute under attacker-controlled timing and potentially bypassing isolation guarantees.

How to fix it

Update the Linux kernel to a version containing commit e3ef461af35a8c74f2f4ce6616491ddb355a208f or later (kernel 6.9 and newer) on all affected AMD SEV hosts.

How to confirm the fix worked

Verify kernel version is 6.9 or newer and confirm the presence of commit e3ef461af35a8c74f2f4ce6616491ddb355a208f in the source tree; test SEV-SNP and SEV-ES guests for expected interrupt behavior.

Typical attack path

1. Gain control of the hypervisor layer hosting AMD SEV guests
2. Inject virtual interrupt 29 into a target SEV-protected guest at chosen times
3. Trigger the #VC handler to interfere with secure state or extract information

How to detect it

Review kernel logs for unexpected #VC interrupt activity on SEV-enabled systems and audit hypervisor logs for interrupt injection events targeting SEV guests.

What your security team should do

• Prioritize kernel upgrades on all AMD SEV hosts to the fixed commit within standard change windows
• Review hypervisor trust boundaries for SEV workloads and apply least-privilege controls
• Monitor vendor advisories for backports to supported LTS kernels