CVE-2024-25743

What it actually does

An untrusted hypervisor can inject virtual interrupts 0 and 14 at arbitrary times, directly triggering the SIGFPE signal handler in guest userspace applications on AMD SEV-SNP and SEV-ES guests.

Why it matters to the business

Organizations running AMD SEV-protected virtual machines face risk of unexpected application crashes or denial of service originating from the hypervisor layer, potentially affecting availability of workloads that rely on floating-point operations.

How an attack unfolds

An attacker who controls the hypervisor sends virtual interrupt 0 or 14 into the guest at any moment; the guest kernel does not validate the source and delivers the interrupt, causing userspace floating-point code to receive SIGFPE and execute the registered handler.

How to fix it

Upgrade the Linux kernel to a version that properly validates virtual interrupt sources for SEV-SNP and SEV-ES guests; if a fixed kernel is unavailable, consider disabling SEV features or isolating untrusted hypervisors until patches are applied.

How to confirm the fix worked

Boot the patched kernel on AMD SEV-SNP/ES hardware, attempt hypervisor-driven interrupt injection of vectors 0 and 14, and confirm that SIGFPE is no longer delivered to userspace without guest kernel mediation.

Typical attack path

1. Gain control of the hypervisor managing an AMD SEV-SNP or SEV-ES guest
2. Inject virtual interrupt 0 or 14 into the running guest at a chosen time
3. Trigger SIGFPE delivery to a userspace application performing floating-point operations
4. Observe or abuse the resulting signal handler execution for denial of service or further impact

How to detect it

Search guest kernel logs for unexpected SIGFPE deliveries correlated with hypervisor activity; examine SEV-related interrupt handling paths in kernel traces for signs of external injection.

What your security team should do

• Prioritize kernel updates on all AMD SEV-SNP and SEV-ES hosts once fixed versions are released
• Review hypervisor trust boundaries and limit exposure of SEV-protected guests to untrusted hosts
• Monitor EPSS and KEV status for changes given the low but non-zero exploitability score