AMD IOMMU - not re-initialized during DRTM (AMD-SB-3003): The IOMMU is not re-initialized during a Dynamic Root of

Impact

The IOMMU is not re-initialized during a Dynamic Root of Trust for Measurement launch, so stale DMA mappings survive into the measured environment and an attacker can read or modify **hypervisor** memory via a device. DRTM exists precisely to establish a clean, measured starting state; leaving the IOMMU stale means the thing you are measuring can already be under device-level attack. On a GPU host, where accelerators and RDMA NICs are DMA-capable and numerous, that is a large set of devices to leave pointed at hypervisor memory.

Who can reach it

Local, requires the ability to set up DMA mappings before a DRTM launch and to drive a device afterwards.

What to do

Fixed in AMD PI/AGESA firmware and delivered only as an OEM SBIOS package - AMD ships the PI drop to Dell, HPE, Supermicro, Lenovo and the ODMs, who each requalify before releasing BIOS. **Budget one to six months of OEM lag**, and note that several CVEs in this batch are marked 'no fix planned' on Naples (EPYC 7001) - for those the only remediation is retiring the hardware. Applying it means cordon, drain and a full power cycle per node; there is no driver reload, no live patch and no VBIOS step.

References

Related entries

• Netdata: Agent MACHINE GUID is readable and reusableCVE-2023-22497 · NetdataMedium
• Apache Guacamole: Miscalculated instruction lengths during the Guacamole handshakeCVE-2023-30575 · Apache GuacamoleMedium
• Elasticsearch: Crafted _search query stringCVE-2023-31419 · ElasticsearchMedium
• Argo CD: repo-server extracts a user-controlled tar.gz without size validationCVE-2023-40584 · Argo CDMedium
• Samba: SMB client can truncate files despite read-only permissions when acl_xattr ignores system ACLsCVE-2023-4091 · SambaMedium
• Ceph RGW (IBM Spectrum Fusion HCI): Improper bucket access lets an actor perform unauthorized actions in RGWCVE-2023-43040 · Ceph RGW (IBM Spectrum Fusion HCI)Medium