AMD PSP - System Management Network privileged register zeroing: An attacker can zero any privileged register on the

CVSS 7.8CVE-2020-12961Firmware, BMC & network fabriccurated

Impact

An attacker can zero any privileged register on the System Management Network via the PSP. Zeroing SMN registers is a general-purpose way to disable platform protections - lock bits, access-control gates, security configuration - which turns into a bypass of whatever those registers were enforcing. It is a primitive rather than a single bug: whatever protection you were relying on at the SMN level can be switched off.

Who can reach it

Local, privileged, through the PSP interface.

What to do

Fixed in AMD reference firmware (AGESA / PSP / SEV firmware) and delivered only as an OEM SBIOS/BIOS package - Dell, HPE, Supermicro, Lenovo and the ODMs each rebuild and requalify AMD's AGESA drop before shipping. **Expect one to six months of OEM lag**, and on end-of-support platforms expect nothing. Applying it is a drain plus full power cycle, not a driver reload. Verify by reading back the PSP/SMU firmware version afterwards rather than trusting the BIOS version string.

References

https://nvd.nist.gov/vuln/detail/CVE-2020-12961 https://www.amd.com/en/resources/product-security.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.