New Mior and Skyfall Attacks Exploit AMD SEV-SNP to Leak and Alter VM Memory from Rogue Hypervisors
Researchers at ETH Zurich and Google disclosed two attacks, Mior and Skyfall, that undermine the security of AMD SEV-SNP protected virtual machines (VMs) on EPYC processors by enabling a malicious hypervisor to read and, in Mior's case, alter VM memory. Mior exploits a startup flaw in the Platform Security Processor's Reverse Map Table initialization, requiring control over the BIOS, hypervisor, and a PCIe device, allowing memory manipulation and falsification of VM attestation reports. Skyfall leverages Transient Scheduler Attacks to extract saved VM register values and limited memory cache lines, without hardware tampering but needing a malicious hypervisor. Both attacks have been tested successfully on several EPYC generations, with AMD issuing firmware and microcode updates alongside vendor BIOS patches. Although not yet observed in active exploitation, these vulnerabilities show critical risks for confidential computing environments relying on SEV-SNP, dependent on cloud provider patch deployment for mitigation.
Entenda a falha
A vulnerabilidade
Mior (CVE-2026-0462, CVSS 4.0 5.9) is a flaw in how AMD SEV-SNP initializes the Reverse Map Table (RMP) at start-up on EPYC processors. The attacker needs control of the hypervisor, the BIOS/UEFI and a PCIe device such as a GPU. With these they can read and write a confidential VM's memory and fake its attestation reports. Skyfall (CVE-2026-40671, 4.9) builds on Transient Scheduler Attacks (TSA) and needs only a malicious hypervisor. It leaks a VM's saved register values and three fixed cache lines of a targeted page. A related CVE-2026-18448 (5.6) covers Skyfall's SMM leak, caused by missing TSA mitigations in EDK II firmware. AMD lists EPYC 7313, 9124, 9135 and 9334 lines. Fixes are SEV firmware and microcode dated August 12, with BIOS updates from server makers due in November (Skyfall) and December (Mior).
Como funciona
In Mior, SEV-SNP starts and the Platform Security Processor (PSP) fills in the RMP, which records who owns each memory page and what they may do with it. The attacker redirects the PSP's writes to the memory of a PCIe graphics card they control. The researchers believe the PSP reads the values back to check them, and the card can return them. Start-up finishes without errors, but part of the real RMP stays uninitialized, including the entry that protects the table. The hypervisor can then rewrite RMP protections. In Skyfall, the hypervisor deliberately makes a VM fail to start. The processor has already cached part of the VM's saved state and leaves it behind without cleanup, and the hypervisor reads it through TSA timing leaks.
Por que é vulnerável
Mior stems from the start-up sequence trusting that the PSP's RMP writes reached main memory and validating them in a way that a device returning the expected values can satisfy. AMD's threat model distrusts the UEFI, yet the BIOS can leave memory-routing settings unlocked, so the initialization can be subverted. Mior is separate from the earlier Fabricked and RMPocalypse flaws and also worked on firmware from before the Fabricked fix. Skyfall's cause is that state of a failed VM start remains in the cache without the usual cleanup, which TSA can then leak. The EDK II issue is missing TSA mitigations in firmware code. The fixes are updated SEV firmware and microcode, and the EDK II patch.
Como foi descoberta
Mior was found by a team at ETH Zurich, which attacked SEV-SNP during start-up. Skyfall comes from a team at ETH Zurich and Google, building on TSA, first disclosed on July 8, 2025. The Skyfall paper was accepted at the IEEE Symposium on Security and Privacy, whose program committee said it overlooks what a realistic VM attack would need. AMD published advisories with firmware and microcode dated August 12, and the attacks became public this week. The articles do not say how or when the reports reached AMD. Neither advisory says whether the flaws have been used in attacks.
PoC pública
Both research teams have published code. In lab tests Mior worked on an EPYC 9135 (Zen 5): enabling debug on a VM and using the PSP's debug commands to read and write memory succeeded in all 1,000 attempts, and a harmless VM's measurement was copied into a malicious VM to fake attestation. This also worked with ciphertext hiding on. The Mior proof-of-concept code needs a BIOS patched to leave memory-routing settings unlocked. Skyfall recovered register values and a disk-encryption key from a test VM on EPYC 7313, 9124 and 9334, but not on Zen 5. Both are lab demonstrations needing a malicious host, so urgency depends on exposure to untrusted hypervisors.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 14:15.
Linha do tempo
-
New Mior and Skyfall Attacks Exploit AMD SEV-SNP to Leak and Alter VM Memory from Rogue Hypervisors
ler a análise desta fonte ocultar
Researchers at ETH Zurich and Google disclosed two attacks, Mior and Skyfall, that undermine the security of AMD SEV-SNP protected virtual machines (VMs) on EPYC processors by enabling a malicious hypervisor to read and, in Mior's case, alter VM memory. Mior exploits a startup flaw in the Platform Security Processor's Reverse Map Table initialization, requiring control over the BIOS, hypervisor, and a PCIe device, allowing memory manipulation and falsification of VM attestation reports. Skyfall leverages Transient Scheduler Attacks to extract saved VM register values and limited memory cache lines, without hardware tampering but needing a malicious hypervisor. Both attacks have been tested successfully on several EPYC generations, with AMD issuing firmware and microcode updates alongside vendor BIOS patches. Although not yet observed in active exploitation, these vulnerabilities show critical risks for confidential computing environments relying on SEV-SNP, dependent on cloud provider patch deployment for mitigation.