AMD SMM communications buffer - TOCTOU (AMD-SB-3003): MULTI-TENANT ISOLATION: A time-of-check-to-time-of-use race

Impact

MULTI-TENANT ISOLATION: A time-of-check-to-time-of-use race on the SMM communications buffer lets ring-0 code swap the buffer contents between validation and use, reaching arbitrary code execution in System Management Mode. Disclosed in the same August 2024 AMD server bulletin as SinkClose, and the same practical outcome: host root becomes ring -2, which is a compromise you cannot clean by reimaging.

Who can reach it

Local, requires ring-0 plus access to the BIOS menu or a UEFI shell - a meaningfully higher bar than plain root, but well within reach of anyone with physical or BMC-mediated console access to the node.

What to do

Fixed in AMD PI/AGESA firmware and delivered only as an OEM SBIOS package - AMD ships the PI drop to Dell, HPE, Supermicro, Lenovo and the ODMs, who each requalify before releasing BIOS. **Budget one to six months of OEM lag**, and note that several CVEs in this batch are marked 'no fix planned' on Naples (EPYC 7001) - for those the only remediation is retiring the hardware. Applying it means cordon, drain and a full power cycle per node; there is no driver reload, no live patch and no VBIOS step. Because the extra prerequisite is console/UEFI-shell access, BMC hardening is a genuine compensating control: restrict who can reach the virtual console and who can reboot a node into firmware setup.

References