The Linux kernel's KVM SEV subsystem did not enforce that the software scratch area reside within the GHCB's shared buffer when using GHCB v2+, violating the GHCB specification. This allowed a malicious SEV-SNP guest to control the allocation size and entry indices for Page State Change (PSC) requests, causing out-of-bounds (OOB) reads and writes in the host kernel heap. Specifically, the guest could set an end_entry index beyond the allocated buffer, leading to OOB access of adjacent slab objects. This results in information disclosure (heap layout leaks) and heap corruption by writing controlled values into adjacent memory. The guest can also trigger use-after-free conditions by firing multiple VMGEXITs. The vulnerability is confirmed by numerous KASAN reports demonstrating slab-out-of-bounds reads and writes. The issue has been fixed by requiring the scratch area to reside in the GHCB shared buffer as per the specification.

A malicious SEV-SNP guest can exploit this vulnerability to read out-of-bounds memory from the host kernel heap, leaking sensitive heap layout information. It can also corrupt host kernel heap memory by writing out-of-bounds, potentially destabilizing the host or enabling further attacks. Use-after-free conditions can be triggered, increasing the risk of arbitrary code execution or denial of service on the host. The vulnerability affects confidentiality, integrity, and availability of the host system.

A fix has been implemented in the Linux kernel to require the in-GHCB scratch area when GHCB v2+ is in use, enforcing the GHCB specification and preventing out-of-bounds accesses. Users should update to a Linux kernel version that includes this fix. No additional mitigation is required if the system is running a patched kernel.