CVE-2023-20585 - Are there any mitigation plans for this?

[Denis Legalov]

Hello Ubuntu Kernel Team,

tl;dr: Will there be a mitigation for CVE-2023-20585 in the Ubuntu kernel in the near term, and what can be done for this?

I am part of the backend team at Fortanix, Inc, and part of our work involves attesting AMD SEV SNP machines.
Recently, there was an issue with attesting an Ubuntu machine, running 6.17.0-35-generic.
Our attestation requires certain TCB parameters to be set, reflecting the security patch state of AMD's advisories.
Due to the kernel component needed for this CVE, our attestation was not going as expected.

The listing for this CVE is here:
https://ubuntu.com/security/CVE-2023-20585#notes (Ubuntu listing)
https://security-tracker.debian.org/tracker/CVE-2023-20585
https://www.cve.org/CVERecord?id=CVE-2023-20585

The security bulletin is here:
https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3016.html

According to this bulletin, the operating system must also have a mitigation, the firmware is not enough:
Note: Mitigation of this vulnerability requires both a SEV firmware update and an OS-specific update.  Mitigations may be deployed in any order, but both are required. Mitigation also requires SNP guest shutdown and reinitialization.
For mitigations requiring operating system (OS) updates, AMD recommends consulting with your operating system vendor’s documentation for information on how to enable the OS portion of the mitigation.
There appear to be patches related to this CVE:
https://lore.kernel.org/linux-iommu/20260420084204.12263-2-vasant.hegde@amd.com/
The current status of this on ubuntu.com is "Needs evaluation", and "which is not clear yet what it is about" in regard to AMD's bulletin, which indicates that more research is needed. With the priority of this as "Medium", we would like to know if there is any timeline on this fix making it into the standard kernel. If there is no current priority, can Fortanix do something to resolve this?
Thank you,
Denis Legalov

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260630/420bb219/attachment.html>