Processor vulnerability
CVE-2025-29943
A hypervisor could set an undocumented configuration bit and corrupt the stack pointer of an SEV-SNP guest running on the sibling SMT thread.
- Name
- SEV-SNP guest stack pointer corruption
- Vulnerability
- AMD SEV, SEV-ES and SEV-SNP
- Kind
- Other
- CVE published
- 2026-01-16 CVE record
- Advisories
- AMD-SB-3027
Researchers flipped an undocumented MSR bit that changes the
configuration of the processor’s pipeline. AMD attributes it to
missing access control, which let the hypervisor set the bit; the
effect is a corrupted stack pointer in an SEV-SNP guest on the other
thread of the same core. The fix is microcode, standalone or in the
PI firmware, for the third to fifth EPYC generations; the first two
generations and the EPYC 4004 series are not affected.What the sources say of each microarchitecture.
Affected processors
3 of the 5 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Zen 3 | Affected | Milan and Milan-X: microcode or MilanPI 1.0.0.H | amd.com |
| Zen 5 | Affected | Turin and Turin Dense: microcode or TurinPI 1.0.0.6 | amd.com |
| Zen 4 | Some models | Genoa, Genoa-X, Bergamo and Siena: microcode or GenoaPI 1.0.0.H; Raphael (EPYC 4004): not affected | amd.com |
| Zen | Not affected | Naples: not affected | amd.com |
| Zen 2 | Not affected | Rome: not affected | amd.com |
Mitigations
- Microcode: Microcode, standalone or in the PI firmware. Source.
Related CVEs
- CVE-2019-9836 SEV key recovery through invalid curve points
- CVE-2020-12966 Ciphertext side channel on SEV-ES register state
- CVE-2020-12967 Unprotected nested page tables of SEV guests
- CVE-2021-26311 Rearranged guest memory that attestation misses
- CVE-2021-26320 SEND_START signing key check
- CVE-2021-26321 ID command validation
- CVE-2021-26323 SEV commands while SNP is active
- CVE-2021-26324 SEV-ES TMR and SNP guests
- CVE-2021-26325 SNP_GUEST_REQUEST input
- CVE-2021-26326 VM_HSAVE_PA at SNP_INIT
- CVE-2021-26327 SNP guest context validation
- CVE-2021-26328 CPU mode at SNP_INIT
- CVE-2021-26332 SEV-ES TMR in MMIO space
- CVE-2021-26340 TLB poisoning of SEV guests
- CVE-2021-26342 Missed TLB flush after a new VMCB
- CVE-2021-26349 Report ID of an imported SNP guest
- CVE-2021-26396 Secure Processor I/O address mapping
- CVE-2021-26402 Mailbox writes into SMM or SEV-ES memory
- CVE-2021-26403 Launch secret disclosure
- CVE-2021-26404 SEV firmware scratch buffer leak
- CVE-2021-26406 OCA certificate parsing
- CVE-2021-26408 Curve points in legacy SEV migration
- CVE-2021-26409 RMP corruption through SEV-ES
- CVE-2021-46744 Ciphertext side channels on SEV
- CVE-2021-46768 Bootloader reads from SEV firmware input
- CVE-2022-23813 SNP policy in Secure Processor and SMU interfaces
- CVE-2022-23814 Addresses passed to BIOS commands
- CVE-2022-23818 VM_HSAVE_PA input validation
- CVE-2022-23830 SMM configuration under SNP
- CVE-2023-20519 Use after free of an SNP guest context page
- CVE-2023-20566 Secure Processor address checks under SNP
- CVE-2023-20573 Suppressed debug exceptions in SNP guests
- CVE-2023-20575 Power side channel on SEV guests
- CVE-2023-20581 IOMMU access control bypasses RMP checks
- CVE-2023-20582 Invalid nested page table entries in the IOMMU
- CVE-2023-20584 IOMMU device table faults bypass RMP checks
- CVE-2023-20585 RMP checks on IOMMU host buffer access
- CVE-2023-20592 INVD and guest memory integrity
- CVE-2023-31346 Uninitialized SEV firmware memory
- CVE-2023-31347 Secure TSC bug
- CVE-2023-31351 IOMMU access to guest private memory
- CVE-2023-31352 SEV firmware reads of unencrypted memory
- CVE-2023-31355 UMC seed overwrite in SNP firmware
- CVE-2023-31356 Incomplete memory cleanup in SEV firmware
- CVE-2024-21944 Memory aliasing through DIMM SPD data
- CVE-2024-21953 IOMMU register reconfiguration
- CVE-2024-21977 RDRAND entropy after a microcode load
- CVE-2024-21978 SEV-SNP input validation
- CVE-2024-21980 SNP firmware write restrictions
- CVE-2024-36331 Uninitialized cache memory
- CVE-2025-0012 Overlap of the segmented RMP and SMM memory
- CVE-2025-0029 Dropped guest DMA writes
- CVE-2025-0031 SINGLE_SOCKET policy after migration
- CVE-2025-0033 RMP corruption during SNP initialization
- CVE-2025-29934 Stale TLB entries in SEV-SNP guests
- CVE-2025-29939 RMP writes during SNP initialization
- CVE-2025-29946 Incomplete IOMMU flush
- CVE-2025-29948 RMP protection bypass in SEV firmware
- CVE-2025-29952 RMP-covered memory corruption
- CVE-2025-48509 I/O memory misidentified at RMP initialization
- CVE-2025-48514 SEV-ES guest attacking an SNP guest
- CVE-2025-48517 SEV-ES guest with an SNP ASID
- CVE-2025-52536 SEV firmware downgrade
- CVE-2025-54510 MMIO routing lock in Secure Processor firmware
- CVE-2025-61971 MMIO routing through NBIO registers
- CVE-2025-61972 SMN access through NBIO registers