3 ms·

Not at all. SEV has been broken many times and by more trivial means [1-3] [1] https://arxiv.org/pdf/1805.09604.pdf https://arxiv.org/pdf/1805.09604.pdf [2] h

• benlivengood 6y ago
  The two attack vectors are page table integrity and unencrypted VM state. Modifying the page tables to establish a cryptographic merkle tree would fix the first attack, and SEV-ES fixes the secrecy attack from the second paper. Unfortunately a change to page table structure may make it impossible to run unmodified kernels in the VM. I think it as impossible to prevent a hypervisor from fingerprinting what's running on a child VM; there are too many timing and power attacks to ever mitigate that, which was the attack vector on SEV-ES