AmdPlatformRasSspSmm - SMM callout (AMD-SB-7028): MULTI-TENANT ISOLATION: An SMM callout in the platform RAS SMM driver

Impact

MULTI-TENANT ISOLATION: An SMM callout in the platform RAS SMM driver lets ring-0 code modify boot service handlers and execute at SMM. Reported by Eclypsium. Worth noting the irony for a GPU operator: the affected driver is the platform's *reliability and error-reporting* code, so the component you depend on to tell you a node is unhealthy is the one handing over the platform.

Who can reach it

Local, ring-0 on the host.

What to do

Fixed in AMD PI/AGESA firmware and delivered only as an OEM SBIOS package - AMD ships the PI drop to Dell, HPE, Supermicro, Lenovo and the ODMs, who each requalify before releasing BIOS. **Budget one to six months of OEM lag**, and note that several CVEs in this batch are marked 'no fix planned' on Naples (EPYC 7001) - for those the only remediation is retiring the hardware. Applying it means cordon, drain and a full power cycle per node; there is no driver reload, no live patch and no VBIOS step.

References