AMD - overlap between segmented reverse map table (RMP) and SMM memory: MULTI-TENANT ISOLATION: Improper handling

Impact

MULTI-TENANT ISOLATION: Improper handling of overlap between the segmented RMP and System Management Mode memory lets a privileged attacker corrupt or partially infer SMM memory. SMM is the most privileged execution context on x86 - above the hypervisor - so reaching it from the RMP path is both a route to total platform control and, in the inference direction, a leak out of the one context nothing else can inspect.

Who can reach it

Local, privileged attacker on a platform using segmented RMP (large-memory SEV-SNP configurations).

What to do

Fixed in AMD firmware/AGESA, delivered as an OEM SBIOS package with **one to six months of OEM lag** and a drained-node power cycle. Because it touches the SEV-SNP trust boundary, refresh VCEK certificates and update tenant attestation policy after the TCB version moves. Segmented RMP is used on very large memory configurations - exactly the shape of an AI training host - so do not assume this is an edge case on a GPU fleet.

References