CVE-2025-38508 (GCVE-0-2025-38508)

Vulnerability from cvelistv5 – Published: 2025-08-16 10:54 – Updated: 2026-08-05 12:02
VLAI
Title
x86/sev: Use TSC_FACTOR for Secure TSC frequency calculation
Summary
In the Linux kernel, the following vulnerability has been resolved: x86/sev: Use TSC_FACTOR for Secure TSC frequency calculation When using Secure TSC, the GUEST_TSC_FREQ MSR reports a frequency based on the nominal P0 frequency, which deviates slightly (typically ~0.2%) from the actual mean TSC frequency due to clocking parameters. Over extended VM uptime, this discrepancy accumulates, causing clock skew between the hypervisor and a SEV-SNP VM, leading to early timer interrupts as perceived by the guest. The guest kernel relies on the reported nominal frequency for TSC-based timekeeping, while the actual frequency set during SNP_LAUNCH_START may differ. This mismatch results in inaccurate time calculations, causing the guest to perceive hrtimers as firing earlier than expected. Utilize the TSC_FACTOR from the SEV firmware's secrets page (see "Secrets Page Format" in the SNP Firmware ABI Specification) to calculate the mean TSC frequency, ensuring accurate timekeeping and mitigating clock skew in SEV-SNP VMs. Use early_ioremap_encrypted() to map the secrets page as ioremap_encrypted() uses kmalloc() which is not available during early TSC initialization and causes a panic. [ bp: Drop the silly dummy var: https://lore.kernel.org/r/20250630192726.GBaGLlHl84xIopx4Pt@fat_crate.local ]
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 73bbf3b0fbba9aa27fef07a1fbd837661a863f03 , < d0195c42e65805938c9eb507657e7cdf8e1e9522 (git)
Affected: 73bbf3b0fbba9aa27fef07a1fbd837661a863f03 , < 52e1a03e6cf61ae165f59f41c44394a653a0a788 (git)
Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.15.7 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/coco/sev/core.c",
            "arch/x86/include/asm/sev.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d0195c42e65805938c9eb507657e7cdf8e1e9522",
              "status": "affected",
              "version": "73bbf3b0fbba9aa27fef07a1fbd837661a863f03",
              "versionType": "git"
            },
            {
              "lessThan": "52e1a03e6cf61ae165f59f41c44394a653a0a788",
              "status": "affected",
              "version": "73bbf3b0fbba9aa27fef07a1fbd837661a863f03",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/coco/sev/core.c",
            "arch/x86/include/asm/sev.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/sev: Use TSC_FACTOR for Secure TSC frequency calculation\n\nWhen using Secure TSC, the GUEST_TSC_FREQ MSR reports a frequency based on\nthe nominal P0 frequency, which deviates slightly (typically ~0.2%) from\nthe actual mean TSC frequency due to clocking parameters.\n\nOver extended VM uptime, this discrepancy accumulates, causing clock skew\nbetween the hypervisor and a SEV-SNP VM, leading to early timer interrupts as\nperceived by the guest.\n\nThe guest kernel relies on the reported nominal frequency for TSC-based\ntimekeeping, while the actual frequency set during SNP_LAUNCH_START may\ndiffer. This mismatch results in inaccurate time calculations, causing the\nguest to perceive hrtimers as firing earlier than expected.\n\nUtilize the TSC_FACTOR from the SEV firmware\u0027s secrets page (see \"Secrets\nPage Format\" in the SNP Firmware ABI Specification) to calculate the mean\nTSC frequency, ensuring accurate timekeeping and mitigating clock skew in\nSEV-SNP VMs.\n\nUse early_ioremap_encrypted() to map the secrets page as\nioremap_encrypted() uses kmalloc() which is not available during early TSC\ninitialization and causes a panic.\n\n  [ bp: Drop the silly dummy var:\n    https://lore.kernel.org/r/20250630192726.GBaGLlHl84xIopx4Pt@fat_crate.local ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defect is in guest early-boot code (`snp_secure_tsc_init()` called from `tsc_early_init()`), reached via a local MSR read on the SEV-SNP guest CPU with no network input of any kind. The relevant adversary in the SNP threat model \u2014 the untrusted hypervisor, or any local guest workload depending on the clock \u2014 operates locally to the machine, which maps to Local.\nAC:L - The miscalculation is fully deterministic: every Secure TSC SNP guest boot reads the nominal P0 frequency and is off by the platform\u0027s TSC_FACTOR, with no race, memory-layout, or timing dependency. SEV-SNP with Secure TSC is a mainstream confidential-computing deployment on current AMD server silicon and `CONFIG_AMD_MEM_ENCRYPT` is enabled in all distro kernels, so no rare configuration is required.\nPR:N - The flaw manifests during `tsc_early_init()` before any userspace or credential exists, so no privileges are held or required at any point on the path. Both the untrusted hypervisor and every unprivileged process in the guest are affected without authenticating to anything.\nUI:N - No victim action is needed \u2014 the wrong TSC frequency is computed automatically on every boot of an affected guest and locked in for the VM\u0027s lifetime. Nothing must be mounted, opened, or configured by a user.\nS:U - The vulnerable component (guest kernel SEV/TSC init) and the impacted component (that same guest kernel\u0027s timekeeping and the workloads relying on it) are within the single security authority of the confidential VM. The hypervisor, IOMMU, and host memory are not reached, so no boundary is crossed.\nC:L - A guest clock that runs uncorrectably slow causes the guest to accept TLS server certificates, Kerberos tickets, and bearer tokens that have actually expired, and destroys the freshness guarantee of timestamped SNP attestation reports, so protected data can be disclosed to peers whose credentials should have been rejected. This is a limited, indirect disclosure rather than arbitrary memory read.\nI:L - Guest monotonic and wall-clock time \u2014 precisely the data Secure TSC is designed to protect the integrity of against an untrusted host \u2014 is silently and permanently wrong, corrupting log and audit timestamps, credential-expiry decisions, and timer deadlines. The modification is bounded and not attacker-directed, so it is limited rather than a full loss of integrity.\nA:H - The bad frequency is unrecoverable \u2014 `X86_FEATURE_TSC_KNOWN_FREQ` makes `init_tsc_clocksource()` skip refined calibration entirely, there is no trusted watchdog clocksource in an SNP guest, and the 2000 ppm error is 4x beyond the kernel NTP discipline\u0027s 500 ppm `MAXFREQ`, so hrtimers misfire and the clock drifts ~3 min/day for the VM\u0027s whole lifetime, evicting the node from lease/heartbeat-based services (etcd, Ceph, Kerberos, cluster quorum). Additionally, the unmasked reserved bits [63:18] of `GUEST_TSC_FREQ` can produce a wildly bogus `tsc_khz`, breaking `udelay()`, `loops_per_jiffy`, and `sched_clock` and hanging the guest \u2014 the fix\u0027s use of `sev_es_terminate()` on failure shows maintainers treat a bad Secure TSC frequency as fatal."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:31.621Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d0195c42e65805938c9eb507657e7cdf8e1e9522"
        },
        {
          "url": "https://git.kernel.org/stable/c/52e1a03e6cf61ae165f59f41c44394a653a0a788"
        }
      ],
      "title": "x86/sev: Use TSC_FACTOR for Secure TSC frequency calculation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38508",
    "datePublished": "2025-08-16T10:54:45.567Z",
    "dateReserved": "2025-04-16T04:51:24.022Z",
    "dateUpdated": "2026-08-05T12:02:31.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38508",
      "date": "2026-08-09",
      "epss": "0.00128",
      "percentile": "0.02794"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38508\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-16T11:15:43.773\",\"lastModified\":\"2026-07-30T06:23:23.177\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/sev: Use TSC_FACTOR for Secure TSC frequency calculation\\n\\nWhen using Secure TSC, the GUEST_TSC_FREQ MSR reports a frequency based on\\nthe nominal P0 frequency, which deviates slightly (typically ~0.2%) from\\nthe actual mean TSC frequency due to clocking parameters.\\n\\nOver extended VM uptime, this discrepancy accumulates, causing clock skew\\nbetween the hypervisor and a SEV-SNP VM, leading to early timer interrupts as\\nperceived by the guest.\\n\\nThe guest kernel relies on the reported nominal frequency for TSC-based\\ntimekeeping, while the actual frequency set during SNP_LAUNCH_START may\\ndiffer. This mismatch results in inaccurate time calculations, causing the\\nguest to perceive hrtimers as firing earlier than expected.\\n\\nUtilize the TSC_FACTOR from the SEV firmware\u0027s secrets page (see \\\"Secrets\\nPage Format\\\" in the SNP Firmware ABI Specification) to calculate the mean\\nTSC frequency, ensuring accurate timekeeping and mitigating clock skew in\\nSEV-SNP VMs.\\n\\nUse early_ioremap_encrypted() to map the secrets page as\\nioremap_encrypted() uses kmalloc() which is not available during early TSC\\ninitialization and causes a panic.\\n\\n  [ bp: Drop the silly dummy var:\\n    https://lore.kernel.org/r/20250630192726.GBaGLlHl84xIopx4Pt@fat_crate.local ]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/sev: Usar TSC_FACTOR para el c\u00e1lculo de frecuencia de Secure TSC. Al usar Secure TSC, el MSR GUEST_TSC_FREQ informa una frecuencia basada en la frecuencia P0 nominal, que se desv\u00eda ligeramente (normalmente ~0,2 %) de la frecuencia media real de TSC debido a los par\u00e1metros de reloj. Con el tiempo de actividad prolongado de la m\u00e1quina virtual, esta discrepancia se acumula, causando un sesgo de reloj entre el hipervisor y una m\u00e1quina virtual SEV-SNP, lo que lleva a interrupciones tempranas del temporizador seg\u00fan lo percibe el invitado. El kernel invitado se basa en la frecuencia nominal informada para el control de tiempo basado en TSC, mientras que la frecuencia real establecida durante SNP_LAUNCH_START puede diferir. Esta falta de coincidencia resulta en c\u00e1lculos de tiempo inexactos, lo que hace que el invitado perciba que los temporizadores hr se activan antes de lo esperado. Utilice el factor TSC_FACTOR de la p\u00e1gina de secretos del firmware SEV (consulte \\\"Formato de la p\u00e1gina de secretos\\\" en la especificaci\u00f3n ABI del firmware SNP) para calcular la frecuencia media de TSC, lo que garantiza una sincronizaci\u00f3n precisa y mitiga el desfase de reloj en las m\u00e1quinas virtuales SEV-SNP. Utilice early_ioremap_encrypted() para mapear la p\u00e1gina de secretos, ya que ioremap_encrypted() utiliza kmalloc(), que no est\u00e1 disponible durante la inicializaci\u00f3n temprana de TSC y provoca un p\u00e1nico. [bp: Eliminar la variable ficticia: https://lore.kernel.org/r/20250630192726.GBaGLlHl84xIopx4Pt@fat_crate.local]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/coco/sev/core.c\",\"arch/x86/include/asm/sev.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"73bbf3b0fbba9aa27fef07a1fbd837661a863f03\",\"lessThan\":\"d0195c42e65805938c9eb507657e7cdf8e1e9522\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"73bbf3b0fbba9aa27fef07a1fbd837661a863f03\",\"lessThan\":\"52e1a03e6cf61ae165f59f41c44394a653a0a788\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/coco/sev/core.c\",\"arch/x86/include/asm/sev.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.7\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":4.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.15.7\",\"matchCriteriaId\":\"68515F48-E05D-4424-B536-E045CCDDFDDA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0517869-312D-4429-80C2-561086E1421C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/52e1a03e6cf61ae165f59f41c44394a653a0a788\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d0195c42e65805938c9eb507657e7cdf8e1e9522\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:27:23+00:00",
      "cve": "CVE-2025-38508",
      "id": "CVE-2025-38508",
      "initial_release_date": "2025-08-16T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: x86/sev: Use TSC_FACTOR for Secure TSC frequency calculation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38508.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T16:50:49Z",
      "cve": "CVE-2025-38508",
      "id": "CVE-2025-38508",
      "initial_release_date": "2025-08-16T23:23:07Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "5",
      "product_status:known_not_affected": "448",
      "product_status:recommended": "154",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38508",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38508.json",
      "version": "30"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.