Luca Wilke

The issue is related to the generation of the ECDSA nonce k, where a random number r is selected and then reduced modulo n, the order of the elliptic curve. The division used during the reduction estimates a factor q e by dividing the upper two digits of r by the upper digit of n and then decrements q e in a loop until it has the correct size. Observing the number of times q e is decremented through a control-flow revealing side-channel reveals a bias in the most significant bits of k. Depending on the curve, this is either a negligible bias or a significant bias large enough to reconstruct k with lattice reduction methods. For SECP160R1, a bias of 15 bits is found.

The issue is related to the implementation of the SEV-SNP (Secure Nested Paging) protective mechanism for virtual machines running on servers with AMD processors, which is associated with data encryption errors. An attacker with access to a malicious hypervisor may be able to infer data values used in a SEV guest on AMD CPUs by monitoring ciphertext values over time.

The issue concerns the AMD SEV/SEV-ES feature, where memory can be rearranged in the guest address space without being detected by the attestation mechanism. This could potentially be exploited by a malicious hypervisor to achieve arbitrary code execution within the guest VM, provided a malicious administrator has access to compromise the server hypervisor.