AMD EPYC Processors SEV Firmware Downgrade Vulnerability

A vulnerability exists in the Secure Encrypted Virtualization (SEV) firmware of AMD EPYC processors, specifically in the 9004 and embedded 9004 series, due to improper prevention of lock bit modification. This flaw could enable a privileged attacker to downgrade the firmware, potentially compromising its integrity. The issue has been acknowledged by AMD and is set to be addressed in a future firmware update.

Impact

Exploitation of this vulnerability could lead to unauthorized firmware downgrades, with potential integrity loss in the affected SEV environment.

Remediation

Users are advised to update to the AMD EPYC Platform Initialization (PI) or Secure Encrypted Virtualization (SEV) firmware version 1.37.31, available through the AMD EPYC Embedded 9004 Series Processors update on January 2, 2026.