x86-64.net

Processor vulnerability

CVE-2024-56161

The same patch loader weakness, as it breaks SEV-SNP: malicious microcode undermines a confidential guest on EPYC from Naples to Turin.

Name
Microcode Signature Verification: SEV-SNP
Vulnerability
Microcode Signature Verification
Kind
Other
CVE published
2025-02-03 CVE record
Advisories
AMD-SB-3019
This is the first CVE of the microcode signature weakness, for its effect on SEV: a host administrator who loads malicious microcode removes the protection SEV-SNP gives a confidential guest. AMD’s mitigation is microcode on every affected EPYC generation, with SEV firmware updates on some so that SEV-SNP attestation can report it.

Affected processors

5 of the 5 microarchitectures listed are affected in all or some of their models.

What the sources say of each microarchitecture.
MicroarchitectureStatusDetailSource
ZenSome modelsEPYC 7001 (Naples)amd.com
Zen 2Some modelsEPYC 7002 (Rome)amd.com
Zen 3Some modelsEPYC 7003 (Milan, Milan-X)amd.com
Zen 4Some modelsEPYC 9004 (Genoa, Genoa-X, Bergamo, Siena)amd.com
Zen 5Some modelsEPYC 9005 (Turin)amd.com

Mitigations

  • Firmware: Microcode in AGESA PI firmware (Naples 0x08001278, Rome 0x0830107D and later per generation), and SEV firmware where SEV-SNP attestation needs it. Source.

Sources

  1. AMD-SB-3019: AMD SEV Confidential Computing Vulnerability