cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Mior and Skyfall Attacks Can Read Data From AMD SEV-SNP VMs

· Original article ↗

Summary

Researchers demonstrated Mior and Skyfall attacks that can expose data from AMD SEV-SNP VMs under different host-control conditions. AMD assigned CVEs and firmware fixes; neither advisory says the flaws have been used in attacks.

Key points

  • Mior (CVE-2026-0462) requires hypervisor and BIOS/UEFI control plus a PCIe device; it disrupts initialization of the Reverse Map Table.
  • In lab tests, Mior enabled VM memory reads and writes and let researchers falsify the software measurement in signed attestation reports.
  • Skyfall (CVE-2026-40671) exploits transient scheduler leakage after failed VM starts; researchers recovered saved register values and a disk-encryption key from a test VM.
  • Skyfall can also read only three specified cache lines in a targeted page. It was tested on Zen 3 and Zen 4 EPYC processors, with no leak demonstrated on Zen 5.
  • Researchers also reported Skyfall leaks involving decrypted microcode updates and System Management Mode data; the EDK II SMM issue is tracked as CVE-2026-18448.
  • The teams report that firmware or microcode mitigations have been released, but the advisories do not clarify whether they work independently or require BIOS updates; no workaround is listed.
  • Neither AMD advisory says the flaws have been used in attacks. Customers renting confidential VMs depend on cloud providers to install host-firmware fixes.

Article Details

Vulnerability Types
  • RMP initialization and memory-protection bypass allowing VM memory reads and writes
  • VM attestation measurement spoofing
  • Transient Scheduler Attack timing side channel leaking cached VM state
  • Missing TSA mitigations in EDK II firmware exposing SMM register data
Severity
Mior (CVE-2026-0462): 5.9; Skyfall VM leak (CVE-2026-40671): 4.9; Skyfall SMM leak (CVE-2026-18448): 5.6.
Affected Versions
  • AMD EPYC 9135 (Mior tested; researchers consider Zen 3 and Zen 4 potentially affected but did not test them)
  • AMD EPYC 7313 (Skyfall tested)
  • AMD EPYC 9124 (Skyfall tested)
  • AMD EPYC 9334 (Skyfall tested)
Exploitation Status
unknown
Exploit Availability
public_poc
Patch Status
partial

CVE

CVE-2026-0462Vendor / Product unavailableAMD tracks Mior as CVE-2026-0462 and rates it 5.9 on the CVSS 4.0 scale in a security advisory. It tracks Skyfall's VM leak as CVE-2026-40671, rated 4.9, in a second advisory that describes the flaw as exposing VMCVE-2026-18448Vendor / Product unavailableThe EDK II project assigned Skyfall's SMM leak CVE-2026-18448 and rates it 5.6. AMD's EDK II bulletin traces it to missing TSA mitigations in EDK II firmware code.CVE-2026-40671Vendor / Product unavailableand rates it 5.9 on the CVSS 4.0 scale in a security advisory. It tracks Skyfall's VM leak as CVE-2026-40671, rated 4.9, in a second advisory that describes the flaw as exposing VM register data.

Vendors

AMDTwo attacks made public this week allow a malicious host to read data inside AMD SEV-SNP-protected virtual machines (VMs), which are built to keep the server's operator out.SupermicroSupermicro, a server maker, has published a BIOS fix list covering flaws in dozens of its H12, H13, and H14 motherboards. The same pages say the boards also need a BMC firmware update and that the company is still

Products

AMD SEV-SNPTwo attacks made public this week allow a malicious host to read data inside AMD SEV-SNP-protected virtual machines (VMs), which are built to keep the server's operator out.EDK IIThe EDK II project assigned Skyfall's SMM leak CVE-2026-18448 and rates it 5.6. AMD's EDK II bulletin traces it to missing TSA mitigations in EDK II firmware code.Epychypervisor, and Mior also needs control of the server's BIOS. Researchers showed both in lab tests on AMD EPYC server processors.

Related Articles