EUVD-2026-59550
GHSA-6wq7-xhx5-p3vw
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Triggering the allocation failure requires engineering memory pressure, elevating AC to H; PR:L and full C/I/A impact are appropriate for a kernel pointer dereference.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp - Check for page allocation failure correctly in TIO
Sashiko notes:
> if __snp_alloc_firmware_pages() returns NULL under memory pressure, is it > safe to pass it directly to page_address()? > > On architectures without HASHED_PAGE_VIRTUAL, page_address(NULL) might > compute a deterministic but invalid, non-zero virtual address. The > subsequent if (tio_status) check would then evaluate to true, and > sev_tsm_init_locked() would dereference the invalid pointer.
Indeed, page_address(NULL) will return non-NULL garbage here. Fix this by checking the page allocation itself for NULL, not the resulting virtual address.
AnalysisAI
Incorrect NULL-check ordering in the Linux kernel's crypto/ccp driver exposes AMD SEV-SNP systems to kernel memory corruption during Trusted I/O firmware initialization. On architectures without HASHED_PAGE_VIRTUAL, passing the return value of __snp_alloc_firmware_pages() directly to page_address() before checking for NULL causes page_address(NULL) to return a deterministic but invalid non-zero address, silently bypassing the allocation-failure guard and allowing sev_tsm_init_locked() to dereference garbage memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local account with at minimum low-privilege user rights (PR:L per provided CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly models local, low-privilege access with full kernel impact, but overstates ease of exploitation in practice. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with a standard user account on an AMD EPYC host running an unpatched kernel with SEV-SNP support allocates large memory blocks to exhaust available page frames, then triggers the SEV-SNP TIO firmware initialization code path. With pages exhausted, __snp_alloc_firmware_pages() returns NULL; page_address(NULL) returns a non-NULL garbage virtual address that bypasses the tio_status guard; sev_tsm_init_locked() dereferences the invalid pointer, leading to kernel memory corruption, a system panic, or - under favorable heap layout - potential privilege escalation. … |
| Remediation | Upgrade to Linux kernel 7.1.5 or 7.2-rc1; on 6.x stable branches, apply commit 17e1aae19a06d9f6da4b46d54fa2aeab77ec0c69 (https://git.kernel.org/stable/c/17e1aae19a06d9f6da4b46d54fa2aeab77ec0c69) or commit a8d5370eef00eca132a292b1901c9914c817e385 (https://git.kernel.org/stable/c/a8d5370eef00eca132a292b1901c9914c817e385) from the Linux stable tree. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and catalog all Linux systems running AMD SEV-SNP with kernel versions earlier than 7.1.5, 7.2-rc1, or 6.19, and assess patch compatibility with your infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today