  AMD SEV-SNP offers VM-level trusted execution environments (TEEs) to protect
the confidentiality and integrity for sensitive cloud workloads from untrusted
hypervisor controlled by the cloud provider. AMD introduced a new exception,
#VC, to facilitate the communication between the VM and the untrusted
hypervisor. We present WeSee attack, where the hypervisor injects malicious #VC
into a victim VM's CPU to compromise the security guarantees of AMD SEV-SNP.
Specifically, WeSee injects interrupt number 29, which delivers a #VC exception
to the VM who then executes the corresponding handler that performs data and
register copies between the VM and the hypervisor. WeSee shows that using
well-crafted #VC injections, the attacker can induce arbitrary behavior in the
VM. Our case-studies demonstrate that WeSee can leak sensitive VM information
(kTLS keys for NGINX), corrupt kernel data (firewall rules), and inject
arbitrary code (launch a root shell from the kernel space).
