AMD EPYC SEV-SNP: debug interface access-control flaw lets a privileged host break guest memory integrity

CVSS 5.9CVE-2025-54501Firmware, BMC & network fabriccurated

Impact

Weak access control on an internal debug interface could let a highly privileged attacker get around memory access controls and damage the integrity of SEV-SNP guest memory. SEV-SNP exists to protect confidential VMs from the host operator, so this weakens what a confidential computing offering on EPYC 7003 and 9005 hosts promises its tenants. The record describes only integrity loss, not confidentiality. It gives no further technical detail.

Who can reach it

Local attacker with high privileges on the host, such as a compromised hypervisor or host root. Guest tenants cannot trigger it.

What to do

Apply the firmware or microcode update that AMD-SB-3054 lists for the affected EPYC processors. Platform firmware usually arrives as an OEM BIOS update, which means taking each node out of service to flash and reboot it. The record does not name fixed versions, so check the bulletin and your server vendor for the right package.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-54501 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3054.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.