PT-2019-6437 · Advanced Micro Devices Inc.+2 · Amd Platform Security Processor+3
Cfir Cohen
·
Published
2019-02-19
·
Updated
2025-02-13
·
CVE-2019-9836
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) Platform Security Processor (PSP) 0.17 build 11 and earlier
Description
The issue is related to an insecure cryptographic implementation in AMD's Secure Encrypted Virtualization (SEV) technology, which can be exploited by a remote attacker to access confidential data. This vulnerability allows for the compromise of protected data by recovering platform Diffie-Hellman keys via an invalid curve attack. The SEV technology provides transparent memory encryption for virtual machines at the hardware level, ensuring that only the current guest system can access decrypted data, while other virtual machines and the hypervisor can only access encrypted data.
Recommendations
For Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) Platform Security Processor (PSP) 0.17 build 11 and earlier, consider disabling the SEV feature until a patch or update is available to address the insecure cryptographic implementation. As a temporary workaround, restrict access to sensitive data and virtual machines to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Use of a Broken Cryptographic Algorithm
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Amd Platform Security Processor
Amd Secure Encrypted Virtualization
Suse