CVE-2022-49556

A flaw was discovered in the Linux kernel’s KVM support for AMD SEV (Secure Encrypted Virtualization). In certain SEV ioctl interfaces, the code used an allocation sized according to user-supplied length, which could be larger than the actual data returned by the Secure Processor. This may result in returning uninitialized kernel memory to user space, potentially exposing sensitive information. Local users with permission to issue SEV ioctl calls may trigger this flaw. The vulnerability has been fixed by switching to zero-initialized allocations and correctly sizing buffers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.