AMD SEV firmware - missing checks around RMP initialization (AMD-SB-3023): Missing checks around RMP initialization

Impact

Missing checks around RMP initialization lead to I/O memory being misidentified, weakening the boundary the reverse-map table enforces. Lowest-severity member of the AMD-SB-3023 RMP batch; include it in the same firmware pass rather than tracking it separately.

Who can reach it

Local, privileged, during SNP platform initialization.

What to do

Fixed in AMD PI/AGESA firmware and delivered only as an OEM SBIOS package - AMD ships the PI drop to Dell, HPE, Supermicro, Lenovo and the ODMs, who each requalify before releasing BIOS. **Budget one to six months of OEM lag**, and note that several CVEs in this batch are marked 'no fix planned' on Naples (EPYC 7001) - for those the only remediation is retiring the hardware. Applying it means cordon, drain and a full power cycle per node; there is no driver reload, no live patch and no VBIOS step. Because this touches the SEV-SNP trust boundary, the update moves the platform TCB version: refresh VCEK certificates from AMD's KDS and update tenant attestation policy, or confidential guest launches will fail immediately after the BIOS lands.

References

Related entries

• AMD Secure Processor - incomplete cleanup exposing the Master Encryption Key (AMD-SB-3003): Incomplete cleanup in theCVE-2023-20518 · AMD Secure Processor - incomplete cleanup exposing the Master Encryption Key (AMD-SB-3003)Low
• Lenovo XClarity OneCLI: temp file handling lets a local user overwrite files when the tool runs elevatedCVE-2026-16791 · Lenovo XClarity Essentials OneCLI (Linux, 5.5.0 and below)Low
• Wiwynn / Celestica / Ingrasys (Foxconn) / AIC BMC firmware: This vendor's firmware is unmeasurable from public dataNCVD-2026-015-wiwynn-celestica-ingrasys-foxcon · Wiwynn / Celestica / Ingrasys (Foxconn) / AIC BMC firmwareUnscored
• Xen on older AMD CPUs - 64-bit PV guest processor erratum: Xen 4.0 and 4.1 running a 64-bit PV guest on older AMD CPUsCVE-2012-2934 · Xen on older AMD CPUs - 64-bit PV guest processor erratumUnscored
• AMD 16h processor microcode - locked instructions vs write-combined memory: Interaction between locked instructionsCVE-2013-6885 · AMD 16h processor microcode - locked instructions vs write-combined memoryUnscored
• Juniper Junos OS MACsec key configuration (CKN/CAK): If you configure a MACsec connectivity-association name or keyCVE-2018-0021 · Juniper Junos OS MACsec key configuration (CKN/CAK)Unscored