Two attacks published this week let a malicious host read data inside AMD SEV-SNP confidential VMs, The Hacker News reports. SEV-SNP is supposed to keep even the server operator out. Mior, from an ETH Zurich team, can also modify a VM’s memory and fake the signed attestation report about what software it runs.
Both need control of the hypervisor; Mior also needs the BIOS/UEFI and a PCIe device like a graphics card. The team redirected the Platform Security Processor’s writes during startup so part of the Reverse Map Table stayed uninitialized, then used the PSP’s own debug commands to read and write a VM’s memory. It worked in all 1,000 attempts across two test runs. AMD lists SEV firmware for Mior and microcode for Skyfall dated Aug. 12, but plans to give server makers platform firmware in November for Skyfall and in December for Mior, with embedded chips later. Customers are told to get BIOS updates from their server maker.
My take
These are lab attacks that need a lot of control, so don’t panic. But confidential computing’s whole promise is “you don’t have to trust the host.” If you’re paying for that, ask your cloud or server vendor when the platform firmware lands. Until then, it’s not fully closed.
God Bless, and Needs Garlic!
