Researchers have disclosed two new security attacks named Mior and Skyfall that demonstrate how a malicious cloud host with privileged access could potentially read sensitive information stored inside confidential virtual machines protected by AMD Secure Encrypted Virtualization Secure Nested Paging (SEV SNP). The findings, published by research teams from ETH Zurich and Google, highlight weaknesses that affect specific AMD EPYC server processors under particular conditions. AMD has acknowledged the vulnerabilities, assigned official CVE identifiers and released firmware and microcode updates while advising customers to install BIOS updates provided by their server manufacturers. According to the published advisories, there is currently no evidence that either vulnerability has been exploited in real world attacks.
SEV SNP is designed to provide confidential computing by encrypting virtual machine memory and preventing hypervisors from accessing protected workloads. The Mior research demonstrated that an attacker with control of both the hypervisor and the server BIOS could interfere with the virtual machine startup process by manipulating the Reverse Map Table, a component that tracks ownership and permissions of memory pages. During laboratory testing on an AMD EPYC 9135 processor, researchers redirected Platform Security Processor memory operations through a controlled PCIe graphics device, allowing portions of the security table to remain uninitialized without interrupting system startup. This enabled modification of memory protections, activation of debugging functions on confidential virtual machines and access to protected memory using processor debug commands. Researchers also showed that software measurements used for virtual machine attestation could be replaced with measurements from another virtual machine, allowing reports to describe a trusted software image while a different workload was running. The researchers noted that the attack requires extensive privileged access, including control of server firmware and hardware configuration, making it applicable only under a specific threat model.
The second research project, named Skyfall, builds upon previously disclosed Transient Scheduler Attack techniques affecting AMD processors. Researchers found that when a hypervisor deliberately interrupts the startup of a confidential virtual machine, portions of processor state may remain temporarily cached and could potentially be recovered through timing based side channel analysis. During controlled testing on AMD EPYC Zen 3 and Zen 4 processors, the team recovered register values and a disk encryption key from a test environment. The researchers also demonstrated limited recovery of selected memory cache lines from targeted memory pages and showed that privileged software could access decrypted microcode updates and register values stored within System Management Mode memory. However, the IEEE Symposium on Security and Privacy program committee noted that practical exploitation would require highly specific operating conditions, including processor resources dedicated to the attack, repeated failed virtual machine launches and sustained performance monitoring, which may reduce real world feasibility.
AMD has classified Mior as CVE-2026-0462 with a CVSS score of 5.9 and Skyfall virtual machine information disclosure as CVE-2026-40671 with a CVSS score of 4.9. The company released updated SEV firmware and processor microcode in August while platform firmware updates for supported EPYC 7003, 8004, 8005, 9004 and 9005 processor families are being distributed through server manufacturers during November and December. Supermicro has also published BIOS updates covering numerous server platforms and recommends accompanying BMC firmware updates where applicable. Because mitigation depends on host firmware rather than guest operating systems, organisations using confidential virtual machines in cloud environments will rely on cloud service providers to deploy the required updates. AMD also published guidance for trusted computing base values used during attestation, while researchers released proof of concept code to support further academic analysis. The published advisories continue to state that no confirmed exploitation of either vulnerability has been observed outside controlled research environments.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
