AMD Secure Processor PCI driver - use-after-free: A use-after-free reachable through the ASP PCI driver

CVSS 6.9CVE-2025-48521Firmware, BMC & network fabriccurated

Impact

A use-after-free reachable through the ASP PCI driver. Beyond the crash, freed-then-reused kernel memory is a corruption primitive, so the honest read is loss of platform integrity rather than simple denial of service.

Who can reach it

Local, via the ASP PCI driver interface; requires access to the crypto/PSP device, i.e. host-level not tenant-level.

What to do

Fixed in AMD reference firmware (AGESA / SEV firmware) and delivered to you only as an OEM SBIOS/BIOS package - Dell, HPE, Supermicro, Lenovo, Gigabyte and the ODMs each rebuild and requalify AMD's AGESA drop before it ships. **Expect months, not weeks**: AMD publishes the bulletin, the OEM ships BIOS somewhere between one and six months later, and for platforms past their support window it may never arrive at all. Applying it is a full node power cycle with the host drained - not a driver reload, not a live patch. Track it as a firmware campaign per server SKU, not per kernel version, and verify afterwards by reading back the SMU/PSP firmware version rather than trusting the BIOS revision string. Pair the BIOS update with the corresponding kernel ccp driver fix.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-48521 https://www.amd.com/en/resources/product-security.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.