# WeSee: Using Malicious #VC Interrupts to Break AMD SEV-SNP

arXiv: https://arxiv.org/abs/2404.03526 · HTML: https://mlsanity.com/paper/2404.03526/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 4 Apr 2024.

## Built on by (most cited first, 4 of 4)

- [Privacy-Preserving Decentralized AI with Confidential Computing](https://mlsanity.com/paper/2410.13752/) (2024)
- [Confidential Prompting: Privacy-preserving LLM Inference on Cloud](https://mlsanity.com/paper/2409.19134/) (2024)
- [Opal: Private Memory for Personal AI](https://mlsanity.com/paper/2604.02522/) (2026)
- [Protecting Confidentiality, Privacy and Integrity in Collaborative Learning](https://mlsanity.com/paper/2412.08534/) (2024)

## Abstract (arXiv)

AMD SEV-SNP offers VM-level trusted execution environments (TEEs) to protect the confidentiality and integrity for sensitive cloud workloads from untrusted hypervisor controlled by the cloud provider. AMD introduced a new exception, #VC, to facilitate the communication between the VM and the untrusted hypervisor. We present WeSee attack, where the hypervisor injects malicious #VC into a victim VM's CPU to compromise the security guarantees of AMD SEV-SNP. Specifically, WeSee injects interrupt number 29, which delivers a #VC exception to the VM who then executes the corresponding handler that performs data and register copies between the VM and the hypervisor. WeSee shows that using well-crafted #VC injections, the attacker can induce arbitrary behavior in the VM. Our case-studies demonstrate that WeSee can leak sensitive VM information (kTLS keys for NGINX), corrupt kernel data (firewall rules), and inject arbitrary code (launch a root shell from the kernel space).