x86-64.net

Processor vulnerability

CVE-2024-21944

Modified SPD data can make a memory module look larger than it is, so that an attacker can overwrite an SEV-SNP guest's memory through an alias.

Name
Memory aliasing through DIMM SPD data
Vulnerability
AMD SEV, SEV-ES and SEV-SNP
Kind
Firmware
CVE published
2026-06-10 CVE record
Advisories
AMD-SB-3015
A memory module describes itself in its serial presence detect (SPD) data. If an attacker changes that data, physically or on a module that does not lock it, the system can map more memory than exists, and two physical addresses then reach the same cells. Writing through the alias bypasses the protections of SEV-SNP. AMD’s fix, in PI firmware and SEV firmware for the third and fourth EPYC generations, checks for aliases at boot; a guest’s attestation report and the platform status then show the bit ALIAS_CHECK_COMPLETE. AMD also recommends modules that lock their SPD data.

Affected processors

2 of the 2 microarchitectures listed are affected in all or some of their models.

What the sources say of each microarchitecture.
MicroarchitectureStatusDetailSource
Zen 3AffectedMilan and Milan-X: MilanPI 1.0.0.D with SEV firmware 1.55.22 (hex 1.37.16)amd.com
Zen 4AffectedGenoa, Bergamo, Genoa-X and Siena: PI and SEV firmware updatesamd.com

Mitigations

  • Firmware: PI and SEV firmware that check for aliased memory at boot and report ALIAS_CHECK_COMPLETE; modules that lock their SPD data. Source.

Sources

  1. AMD-SB-3015: Undermining Integrity Features of SEV-SNP with Memory Aliasing