CVE-2023-53996

In the Linux kernel, the following vulnerability has been resolved: x86/sev: Make enc_dec_hypercall() accept a size instead of npages enc_dec_hypercall() accepted a page count instead of a size, which forced its callers to round up. As a result, non-page aligned vaddrs caused pages to be spuriously marked as decrypted via the encryption status hypercall, which in turn caused consistent corruption of pages during live migration. Live migration requires accurate encryption status information to avoid migrating pages from the wrong perspective.

CVSS v3 9.3 CRITICAL

9.3^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://git.kernel.org/stable/c/6615212d8e131b45bd9705b0d69cc0d2f624666f
https://git.kernel.org/stable/c/8ae7457e71a320867d868f2622d7c643596e4f43
https://git.kernel.org/stable/c/ac3f9c9f1b37edaa7d1a9b908bc79d843955a1a2
https://git.kernel.org/stable/c/ba50e7773a99a109a1ea6f753b766a080d3b21cc

Configurations

No configuration.

History

No history.

Information

Published : 2025-12-24 11:15

Updated : 2026-08-04 10:19

NVD link : CVE-2023-53996

Mitre link : CVE-2023-53996

CVE.ORG link : CVE-2023-53996

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2023-53996", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "LOCAL", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.5}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "064ce6c550a0630789978bfec7a13ab2bd1bdcdf", "lessThan": "ba50e7773a99a109a1ea6f753b766a080d3b21cc", "versionType": "git"}, {"status": "affected", "version": "064ce6c550a0630789978bfec7a13ab2bd1bdcdf", "lessThan": "6615212d8e131b45bd9705b0d69cc0d2f624666f", "versionType": "git"}, {"status": "affected", "version": "064ce6c550a0630789978bfec7a13ab2bd1bdcdf", "lessThan": "8ae7457e71a320867d868f2622d7c643596e4f43", "versionType": "git"}, {"status": "affected", "version": "064ce6c550a0630789978bfec7a13ab2bd1bdcdf", "lessThan": "ac3f9c9f1b37edaa7d1a9b908bc79d843955a1a2", "versionType": "git"}], "programFiles": ["arch/x86/include/asm/mem_encrypt.h", "arch/x86/kernel/kvm.c", "arch/x86/mm/mem_encrypt_amd.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"status": "unaffected", "version": "0", "lessThan": "5.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.53", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.4.16", "versionType": "semver", "lessThanOrEqual": "6.4.*"}, {"status": "unaffected", "version": "6.5.3", "versionType": "semver", "lessThanOrEqual": "6.5.*"}, {"status": "unaffected", "version": "6.6", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/x86/include/asm/mem_encrypt.h", "arch/x86/kernel/kvm.c", "arch/x86/mm/mem_encrypt_amd.c"], "defaultStatus": "affected"}]}], "published": "2025-12-24T11:15:52.507", "references": [{"url": "https://git.kernel.org/stable/c/6615212d8e131b45bd9705b0d69cc0d2f624666f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8ae7457e71a320867d868f2622d7c643596e4f43", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ac3f9c9f1b37edaa7d1a9b908bc79d843955a1a2", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ba50e7773a99a109a1ea6f753b766a080d3b21cc", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/sev: Make enc_dec_hypercall() accept a size instead of npages\n\nenc_dec_hypercall() accepted a page count instead of a size, which\nforced its callers to round up. As a result, non-page aligned\nvaddrs caused pages to be spuriously marked as decrypted via the\nencryption status hypercall, which in turn caused consistent\ncorruption of pages during live migration. Live migration requires\naccurate encryption status information to avoid migrating pages\nfrom the wrong perspective."}], "lastModified": "2026-08-04T10:19:25.110", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}