Ethical Hacking News
A recent threat discovered by researchers at ETH Zurich exposes secrets from AMD SEV-SNP virtual machines (VMs) to rogue cloud hosts. The vulnerability, known as Mior, was discovered by a team of researchers led by Swati Khandelwal, who demonstrated the attack in lab tests on AMD EPYC server processors. The attack takes advantage of the fact that the Platform Security Processor's writes are redirected to the memory of a graphics card controlled by the attacker, allowing the attacker to read data from the VM. In this article, we will delve into the details of the Mior attack and its implications for cloud security.
The Mior vulnerability exposes secrets from AMD SEV-SNP virtual machines to rogue cloud hosts.The vulnerability takes advantage of the fact that the PSP's writes are redirected to the memory of a graphics card controlled by the attacker.The Mior attack requires control of the server's hypervisor and BIOS, as well as a PCIe device such as a graphics card.The attack can fake the signed report confirming which software the VM runs, allowing the attacker to access confidential data.The Skyfall attack allows a malicious host to read data inside AMD SEV-SNP-protected virtual machines.The Skyfall attack takes advantage of a group of flaws in AMD processors known as Transient Scheduler Attacks (TSA).The attack requires a malicious host or hypervisor, but no tampering with the hardware.The attacks were assigned CVE numbers by AMD, with Mior being rated 5.9 on the CVSS 4.0 scale and Skyfall being rated 4.9.Fixes for the vulnerabilities are expected to be available in December and November, respectively.
The threat landscape continues to evolve with new vulnerabilities being discovered, and in this article, we will delve into a recent threat discovered by researchers at ETH Zurich, which exposes secrets from AMD SEV-SNP virtual machines (VMs) to rogue cloud hosts. The vulnerability, known as Mior, was discovered by a team of researchers led by Swati Khandelwal, who demonstrated the attack in lab tests on AMD EPYC server processors.
SEV-SNP is a hardware-enforced memory encryption and access control mechanism designed to protect VMs from the host's hypervisor, even when running on a cloud provider. The mechanism uses a security co-processor on the chip, the Platform Security Processor (PSP), which fills in a table called the Reverse Map Table (RMP) to record who owns each page of memory and what they may do with it. The attack, known as Mior, takes advantage of the fact that the PSP's writes are redirected to the memory of a graphics card controlled by the attacker, allowing the attacker to read data from the VM.
The attack was demonstrated on an EPYC 9135, a Zen 5 chip, and the researchers showed that it works on both EPYC 9135 and Zen 3 and Zen 4 chips, but they did not test it on Zen 5 chips due to lack of setup. The Mior attack requires control of the server's hypervisor and BIOS, as well as a PCIe device such as a graphics card. The researchers also demonstrated that the attack can fake the signed report confirming which software the VM runs, allowing the attacker to access confidential data.
Another attack, known as Skyfall, was discovered by the same team of researchers and allows a malicious host to read data inside AMD SEV-SNP-protected virtual machines. The attack takes advantage of a group of flaws in AMD processors known as Transient Scheduler Attacks (TSA), which can leak data through instruction timing. The researchers demonstrated that the attack can recover a VM's saved register values and a disk-encryption key from a test VM.
The Skyfall attack requires a malicious host or hypervisor, but no tampering with the hardware, and it can read VM memory, but only three fixed cache lines in a page it targets. The attack was tested on an EPYC 7313, a Zen 3 chip, and on EPYC 9124 and 9334 chips, which are Zen 4. The researchers also demonstrated that the attack can read decrypted microcode updates on all three test chips and recover register values stored in System Management Mode (SMM) memory, which even the operating system kernel cannot read.
Both attacks were assigned CVE numbers by AMD, with Mior being rated 5.9 on the CVSS 4.0 scale and Skyfall being rated 4.9. The researchers have released proof-of-concept code for Mior, which needs a BIOS patched to leave the memory-routing settings unlocked. AMD has listed the same five EPYC server lines for both flaws, with fixes for Mior and Skyfall expected to be available in December and November, respectively.
The discovery of these new vulnerabilities highlights the importance of keeping software up-to-date and implementing robust security measures to protect against cloud-based threats. As the use of cloud services continues to grow, it is essential to stay vigilant and keep pace with the latest threats and vulnerabilities.
Related Information:
https://www.ethicalhackingnews.com/articles/New-Attacks-on-AMD-SEV-SNP-VMs-Expose-Secrets-to-Rogue-Cloud-Hosts-ehn.shtml
https://thehackernews.com/2026/11/new-mior-and-skyfall-attacks-let-rogue.html
Published: Fri Nov 13 10:50:30 2026 by llama3.2 3B Q4_K_M
