AMD Secure Processor boot ROM - physical attacks bypassing secure boot: Physical attacks that bypass secure boot in the

Impact

Physical attacks that bypass secure boot in the ASP boot ROM. Boot ROM is mask-programmed silicon, so the flawed logic itself cannot be patched - only worked around by the firmware layered above it. An attacker who defeats ASP secure boot owns the platform's root of trust from power-on.

Who can reach it

Physical access to the platform.

What to do

**Boot ROM is unpatchable by construction** - any mitigation is compensating logic in AGESA/PI firmware above it, delivered as an OEM BIOS package. The real controls are physical: chain of custody for hardware, tamper evidence, and treating any node returned from third-party hands as untrusted until its firmware is measured and reprovisioned. This is the argument for firmware attestation between bare-metal tenants rather than trusting a reimage.

References

Related entries

• Intel SGX / DDR4 memory bus (physical interposer): WireTap: a low-cost passive DDR4 interposer reads the memory bus ofNCVD-2025-012-intel-sgx-ddr4-memory-bus-physic · Intel SGX / DDR4 memory bus (physical interposer)Unscored
• Intel SGX and AMD SEV-SNP / DRAM interposer (memory aliasing): Battering RAM: a cheap DRAM interposer that aliasesNCVD-2025-013-intel-sgx-and-amd-sev-snp-dram-i · Intel SGX and AMD SEV-SNP / DRAM interposer (memory aliasing)Unscored
• AMD SEV firmware - arbitrary code execution on the AMD Security Processor (physical): An academic disclosure achievingNCVD-2026-002-amd-sev-firmware-arbitrary-code · AMD SEV firmware - arbitrary code execution on the AMD Security Processor (physical)Unscored
• UEFI Secure Boot (Microsoft 2011 CA/KEK expiry): Not an exploitable flaw but a fleet-wide trust-anchor deadlineNCVD-2026-006-uefi-secure-boot-microsoft-2011 · UEFI Secure Boot (Microsoft 2011 CA/KEK expiry)Unscored
• Community / open-source SONiC (sonic-net): Community SONiC — the open-source NOS that a growing share of cost-optimisedNCVD-2026-013-community-open-source-sonic-soni · Community / open-source SONiC (sonic-net)Unscored
• Rack PDU and UPS management estates as a class (all vendors): PHYSICAL, and the most common real-world findingNCVD-2026-018-rack-pdu-and-ups-management-esta · Rack PDU and UPS management estates as a class (all vendors)Unscored