English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Modern enterprises increasingly take advantage of cloud infrastructures. Yet,outsourcing code and data into the cloud requires enterprises to trust cloudproviders not to meddle with their data. To reduce the level of trust towardscloud providers, AMD has introduced Secure Encrypted Virtualization (SEV). Byencrypting Virtual Machines (VMs), SEV aims to ensure data confidentiality,despite a compromised or curious Hypervisor. The SEV Encrypted State (SEV-ES)extension additionally protects the VM's register state from unauthorizedaccess. Yet, both extensions do not provide integrity of the VM's memory, whichhas already been abused to leak the protected data or to alter the VM'scontrol-flow. In this paper, we introduce the SEVerity attack; a missing puzzlepiece in the series of attacks against the AMD SEV family. Specifically, weabuse the system's lack of memory integrity protection to inject and executearbitrary code within SEV-ES-protected VMs. Contrary to previous code executionattacks against the AMD SEV family, SEVerity neither relies on a specific CPUversion nor on any code gadgets inside the VM. Instead, SEVerity abuses thefact that SEV-ES prohibits direct memory access into the encrypted memory.Specifically, SEVerity injects arbitrary code into the encrypted VM through I/Ochannels and uses the Hypervisor to locate and trigger the execution of theencrypted payload. This allows us to sidestep the protection mechanisms ofSEV-ES. Overall, our results demonstrate a success rate of 100% and hencehighlight that memory integrity protection is an obligation when encryptingVMs. Consequently, our work presents the final stroke in a series of attacksagainst AMD SEV and SEV-ES and renders the present implementation as incapableof protecting against a curious, vulnerable, or malicious Hypervisor.

SEVerity: Code Injection Attacks against Encrypted Virtual Machines