AMD EPYC Processors SEV Firmware Access Control Vulnerability
Vulnerability
A vulnerability exists in the Secure Encrypted Virtualization (SEV) firmware of AMD EPYC processors, specifically in the access control granularity. This flaw could enable a privileged user with a malicious hypervisor to create a SEV-ES guest that uses an Address Space ID (ASID) designated for SEV-SNP guests. Such an action could lead to a partial breach of confidentiality.
Impact
Exploitation of this vulnerability could result in a partial loss of confidentiality.
Remediation
Users are advised to update to the AMD EPYC Platform Initialization (PI) or SEV firmware version 1.37.41. For specific BIOS update details, please contact your OEM.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.