USN-6921-2: Linux kernel vulnerabilities
Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde discovered that an untrusted hypervisor could inject malicious #VC interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw is known as WeSee. A local attacker in control of the hypervisor could use this to expose sensitive information or possibly execute arbitrary code in the trusted execution environment. (CVE-2024-25742) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-image-6.8.0-39-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-39.39.1 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-39-lowlatency-64kto a version that resolves this vulnerability.Fixed in 6.8.0-39.39.1 - Upgrade
Upgrade
ubuntu/linux-image-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-39.39.1 - Upgrade
Upgrade
ubuntu/linux-image-lowlatency-64kto a version that resolves this vulnerability.Fixed in 6.8.0-39.39.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch USN-6921-2
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-6921-2?
USN-6921-2 is a critical vulnerability that could allow an untrusted hypervisor to compromise AMD SEV-SNP security guarantees.
How do I fix USN-6921-2?
To fix USN-6921-2, ensure that your system is updated to the latest kernel version 6.8.0-39.39.1 or higher.
Who discovered USN-6921-2?
USN-6921-2 was discovered by researchers Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde.
What systems are affected by USN-6921-2?
USN-6921-2 affects Ubuntu version 24.04 running specific low-latency kernel packages.
What type of attack does USN-6921-2 address?
USN-6921-2 addresses a local attack vector where an attacker in control of the hypervisor can inject malicious VC interrupts.