AMD Secure Processor - XGMI Trusted Agent (TOCTOU): MULTI-TENANT ISOLATION: A TOCTOU race in the ASP's XGMI Trusted

Impact

MULTI-TENANT ISOLATION: A TOCTOU race in the ASP's XGMI Trusted Agent lets an attacker modify Infinity-Fabric/XGMI link commands after they are validated but before they execute. XGMI is the coherent interconnect binding MI-series GPUs together in a node, so tampering with its trusted-agent commands is tampering with the fabric that carries other tenants' model traffic between accelerators.

Who can reach it

Local, host-privileged, and specific to multi-GPU platforms that actually use XGMI - which is every MI200/MI250/MI300 node in an 8-GPU configuration.

What to do

Fixed in AMD reference firmware (AGESA / SEV firmware) and delivered to you only as an OEM SBIOS/BIOS package - Dell, HPE, Supermicro, Lenovo, Gigabyte and the ODMs each rebuild and requalify AMD's AGESA drop before it ships. **Expect months, not weeks**: AMD publishes the bulletin, the OEM ships BIOS somewhere between one and six months later, and for platforms past their support window it may never arrive at all. Applying it is a full node power cycle with the host drained - not a driver reload, not a live patch. Track it as a firmware campaign per server SKU, not per kernel version, and verify afterwards by reading back the SMU/PSP firmware version rather than trusting the BIOS revision string. This one is squarely an Instinct-node issue, not a generic EPYC one: prioritise it on MI250/MI300 hosts where XGMI is carrying real inter-GPU traffic.

References