Bug 2571376 (CVE-2026-40668)
| Summary: | CVE-2026-40668 sev: AMD SEV firmware: Authentication bypass via spoofed attestation requests | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in AMD Secure Encrypted Virtualization (SEV) firmware. An authentication bypass vulnerability allows a malicious hypervisor on the host system to spoof requests and obtain attestation reports for Virtual Machine Privilege Level (VMPL) 0. This issue can compromise the integrity of the guest attestation process, enabling an attacker to misrepresent the security state of the most privileged virtual machine context.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-10 22:21:54 UTC
|