Researchers demonstrated Mior and Skyfall against AMD SEV-SNP virtual machines in lab tests on EPYC server CPUs.
Mior can read and alter VM memory and falsify its signed report; Skyfall recovered a disk-encryption key in a test VM, with access limited to specific memory regions.
Both require server-level control, with Mior also requiring a PCIe device.
A virtual machine is a separate environment that runs inside a larger, physical computer. AMD's SEV-SNP protection is designed to keep its data hidden even from the administrator of the physical computer.
What can Mior and Skyfall do?
Mior can allow the memory of a protected virtual machine to be read and changed. It can also falsify the signed report that certifies what software is running there.
To work, it requires control of the physical computer's management software and basic boot software, as well as an additional device, such as a graphics card. The researchers managed to read and change memory in a total of 1.000 attempts.
Skyfall requires a malicious administrator or control of the physical computer. It does not require any hardware changes. In a test virtual machine, the researchers recovered stored operating values and the digital key used to protect the disk. Access to the memory was limited to three specific parts of a region; the rest was inaccessible.
Which processors are affected?
AMD lists the EPYC 7003, 8004, 8005, 9004, and 9005 series as affected by both attacks. For Mior, it says that only the SEV-SNP protection is affected, not the older SEV and SEV-ES protections.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
SignDrop: New Windows vulnerability could give complete control over the system
↗
Mior was tested on an EPYC 9135, a Zen 5 generation processor. The researchers believe that Zen 3 and Zen 4 generations are also likely to be affected, but they did not test them. Skyfall was tested on an EPYC 7313, a Zen 3 generation processor, and an EPYC 9124 and 9334, a Zen 4 generation processor. The researchers did not see any leaks on Zen 5.
What fixes are being prepared?
Research teams say they have released software fixes. However, AMD's announcements are unclear whether these are sufficient on their own or if a software update is also required. AMD says customers should contact their computer manufacturer to update the software that starts the computer. No workaround has been announced.
The SEV software for Mior and the associated processor software for Skyfall are dated August 12. AMD aims to release updates to the core computer software in November for Skyfall and December for Mior. For embedded EPYC models, updates are expected from January to April 2027. The Instinct MI300A accelerator is listed with a fix for Skyfall dated September 21.
Supermicro has released a list of fixes for dozens of its H12, H13, and H14 series motherboards. It says that the motherboard management software also needs to be updated and that it is continuing to monitor which products are affected.
Those who rent protected virtual machines depend on the service provider to install patches on the physical machine. Both research groups have published test code that shows how the attacks work.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)