Database/Control plane, storage & DevOps

AMD System Management Mode (SMM) interrupt handler: A flaw in the AMD SMM interrupt handler lets a high-privilege

CVSS 8.8CVE-2021-39298Control plane, storage & DevOpscurated

Impact

A flaw in the AMD SMM interrupt handler lets a high-privilege attacker reach System Management Mode and execute arbitrary code there. SMM sits above the hypervisor and above the OS - code running in SMM can read and write all physical memory including SEV-protected regions in some configurations, and it is invisible to every security tool you run. This is the classic 'ring -2' compromise: persistent, undetectable from the OS, and it survives reinstalling everything above it.

Who can reach it

Local, requires high privilege (root) on the host first. Not a tenant-reachable bug, but the payoff for an attacker who already has root is enormous - it converts a recoverable host compromise into an unrecoverable one.

What to do

Fixed in AMD reference firmware (AGESA) and delivered only as an OEM SBIOS package - the OEM rebuild and requalification means **one to six months of lag**, and on end-of-support platforms possibly never. Applying it is a drain plus full power cycle. There is no OS-level mitigation for an SMM handler bug. On a bare-metal fleet, the compensating control is firmware measurement between tenants: if you cannot attest that SMM code is unchanged, you cannot honestly claim a node was cleaned by reimaging.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-39298 https://www.amd.com/en/resources/product-security.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.