CVE-2025-38508

x86/sev: Use TSC_FACTOR for Secure TSC frequency calculation

published August 16, 2025

CVSS
—
EPSS
0%
Percentile
2.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

x86/sev: Use TSC_FACTOR for Secure TSC frequency calculation

When using Secure TSC, the GUEST_TSC_FREQ MSR reports a frequency based on

the nominal P0 frequency, which deviates slightly (typically ~0.2%) from

the actual mean TSC frequency due to clocking parameters.

Over extended VM uptime, this discrepancy accumulates, causing clock skew

between the hypervisor and a SEV-SNP VM, leading to early timer interrupts as

perceived by the guest.

The guest kernel relies on the reported nominal frequency for TSC-based

timekeeping, while the actual frequency set during SNP_LAUNCH_START may

differ. This mismatch results in inaccurate time calculations, causing the

guest to perceive hrtimers as firing earlier than expected.

Utilize the TSC_FACTOR from the SEV firmware's secrets page (see "Secrets

Page Format" in the SNP Firmware ABI Specification) to calculate the mean

TSC frequency, ensuring accurate timekeeping and mitigating clock skew in

SEV-SNP VMs.

Use early_ioremap_encrypted() to map the secrets page as

ioremap_encrypted() uses kmalloc() which is not available during early TSC

initialization and causes a panic.

[ bp: Drop the silly dummy var:

https://lore.kernel.org/r/20250630192726.GBaGLlHl84xIopx4Pt@fat_crate.local ]

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00131 · 2.4th percentile
Published
2025-08-16T10:54Z
EPSS history
Timeline
  • 16 AUG 10:54Z
    x86/sev: Use TSC_FACTOR for Secure TSC frequency calculation
    cvelistv5