AMD EPYC Processors IOMMU Data Removal Vulnerability

A vulnerability exists in certain AMD EPYC processors due to insufficient data removal in the Secure Encrypted Virtualization (SEV) firmware, which does not fully clear the I/O Memory Management Unit (IOMMU). This shortcoming could allow a local privileged attacker to manipulate guest memory, leading to potential confidentiality and integrity breaches.

Impact

Exploitation of this vulnerability could result in unauthorized access to or modification of guest memory, compromising the confidentiality and integrity of that memory.

Remediation

Users can update to the recommended AMD EPYC Platform Initialization (PI) or Secure Encrypted Virtualization (SEV) firmware versions. Specific update details can be found in the AMD Security Bulletin AMD-SB-3023.