CVE-2026-0462 and CVE-2026-40671 describe two new techniques that let a malicious host read — and in one case modify — data inside AMD SEV‑SNP protected virtual machines, the researchers and vendor advisories say.
How Mior breaches SEV‑SNP startup
The ETH Zurich team behind the Mior paper demonstrated a startup-time attack against the Platform Security Processor (PSP) that underpins SEV‑SNP. During VM boot the PSP populates the Reverse Map Table (RMP), which records ownership and access protections for each page of memory. The researchers redirected the PSP’s writes to the memory of a PCIe device they controlled (a graphics card), so the PSP completed startup believing the RMP was initialized while part of the real RMP — including the entry that protects the table itself — remained uninitialized.
That left the hypervisor able to rewrite the RMP protections. The team then enabled debugging on a confidential VM that had debugging disabled and used PSP debug commands to read and write the VM’s memory. The paper reports the technique worked in every attempt: 1,000 successful runs across two test sessions. The team also copied a benign VM’s measured boot image into a malicious VM so the malicious VM’s signed attestation reports described the harmless image.
The Mior paper says the attack requires control of the hypervisor, the system BIOS/UEFI, and a PCIe device; for the tests the researchers deliberately modified the BIOS to leave memory‑routing settings unlocked. The researchers note Mior operates inside AMD’s stated threat model for SEV‑SNP, which explicitly distrusts UEFI.
How Skyfall extracts registers, keys, and microcode
Skyfall, the joint paper from ETH Zurich and Google, builds on Transient Scheduler Attacks (TSAs) and targets data left in cached saved processor state when a VM fails to start. The team found that when a hypervisor forces a VM start to fail, the processor can leave part of the VM’s saved state cached without the usual cleanup, and that TSA techniques allow the host to read that cached state.
In lab tests Skyfall recovered saved register values and a disk‑encryption key from a test VM. For the key the researchers modified the VM kernel to pause when the key resided in registers; they wrote that in a real attack a hypervisor could use SEV‑Step to advance the VM until the key reached registers. Skyfall can also read VM memory, but the paper says only three fixed cache lines in a page are exposed: offsets 0x0c0, 0x380 and 0x3c0.
The Skyfall team additionally recovered decrypted microcode updates and register values stored in System Management Mode (SMM) memory on the chips they tested; those latter two results need privileged software on the host. Skyfall requires a malicious host/hypervisor but does not require tampering with hardware.
The IEEE Symposium on Security and Privacy program committee commented that mounting Skyfall under realistic conditions would demand a processor core free of other activity, intentionally failing VM starts, high‑speed performance‑counter reads, and a VM that does not crash or time out during the attack.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAffected processors and the patch timeline
AMD tracks Mior as CVE‑2026‑0462 with a CVSS 4.0 score of 5.9 and tracks Skyfall’s VM leak as CVE‑2026‑40671 with a score of 4.9. AMD’s advisories list the same five EPYC server lines as affected for both flaws and show microcode and SEV firmware dated August 12. The advisories say AMD plans to provide platform firmware in November for the Skyfall fixes and in December for the Mior fixes; fixes for embedded EPYC models are scheduled between January and April 2027.
AMD’s advisories include the TurinPI_1.0.0.C package referenced against differing target months; the Instinct MI300A accelerator shows a Skyfall patch dated September 21. The advisories do not say whether the microcode or SEV firmware alone is sufficient, or whether the platform vendor BIOS/UEFI update is required; they list no workaround and do not assert whether either flaw has been observed in the wild.
The EDK II project separately assigned the Skyfall SMM leak CVE‑2026‑18448 with a rating of 5.6, attributing it to missing TSA mitigations in EDK II firmware code and recommending prior TSA mitigations plus an EDK II patch. The EDK II bulletin lists EPYC and Ryzen chips and says a patch for the five server lines is due in November; platform firmware with that fix is already available for some other chips, including EPYC 4004 and 4005 models, while the EDK II project’s advisory lists no patched version as of today.
What this means for cloud customers, server makers, and EDK II maintainers
- Cloud customers who rent SEV‑SNP confidential VMs: the fixes are implemented in host firmware and BIOS; customers therefore depend on their cloud provider to install the platform firmware and BIOS updates. AMD’s Mior advisory includes trusted computing base (TCB) values for SNP attestation next to each fixed firmware version, but the advisory does not describe how VM owners should verify them.
- Server makers and board vendors: manufacturers must deliver BIOS/UEFI updates and, in many cases, BMC firmware. Supermicro has published a BIOS fix list covering dozens of H12, H13, and H14 motherboards and notes those boards also require BMC firmware updates; the company is still testing affected products.
- EDK II maintainers: the EDK II bulletin traces an SMM leak to missing TSA mitigations and calls for an EDK II patch in addition to platform microcode — the bulletin lists a November timeline for affected EPYC server lines.
Both research teams have published proof‑of‑concept code; the Mior POC requires a BIOS left in the unpatched configuration that permits the memory‑routing modification the researchers used. That combination — published code, firmware microcode dated August 12, platform firmware delivery timelines, and dependency on vendor BIOS updates — creates a narrow window in which hosts or operators who control firmware could exploit these vectors if they do not apply the promised updates.
Link to original: https://thehackernews.com/2026/11/new-mior-and-skyfall-attacks-let-rogue.html
