USN-9091-1: Linux kernel (NVIDIA Tegra) vulnerabilities
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1039-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1039.40 - Upgrade
Upgrade
ubuntu/linux-image-6.8.0-1039-nvidia-tegra-rtto a version that resolves this vulnerability.Fixed in 6.8.0-1039.40 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1039.40 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-tegra-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1039.40 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-tegra-rtto a version that resolves this vulnerability.Fixed in 6.8.0-1039.40 - Upgrade
Upgrade
ubuntu/linux-image-nvidia-tegra-rt-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1039.40
Event History
Frequently Asked Questions
What access does an attacker need to exploit the RMP-check issue?
The described attack requires local access with hypervisor privileges. It targets AMD systems using SEV-SNP guest memory.
What is the potential impact of the RMP-check issue?
An attacker could trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. The notice does not describe confidentiality or availability impact for this issue.
Which installed kernel packages are covered by this update?
The update covers Ubuntu NVIDIA Tegra kernel image packages, including linux-image-6.8.0-1039-nvidia-tegra and linux-image-6.8.0-1039-nvidia-tegra-rt, along with the associated nvidia-tegra and nvidia-tegra-rt meta-packages.