This vulnerability (CVE-2025-54510) affects AMD EPYC 9004 Series Processors firmware and is classified as CWE-414 (Missing Lock Check). It allows a malicious hypervisor to modify BIOS settings and Memory Mapped I/O routing configurations, which can compromise the confidentiality and integrity of Confidential VMs running AMD SEV-SNP guests. Google has deployed mitigations preventing exploitation of this issue in their Confidential VM instances. No official remediation level or patch details are provided by AMD, and no direct patch links are available. The CVSS 4.0 base score is 5.9, indicating medium severity.

The vulnerability could allow a malicious hypervisor to alter critical firmware configurations, impacting the confidentiality and integrity of Confidential VMs using AMD SEV-SNP technology. This could undermine the security guarantees of these virtual machines in cloud environments. However, mitigations have been implemented by Google for their Confidential VM instances, reducing the risk for those users.

No customer action is required as mitigations have already been applied to Confidential VM instances with AMD SEV-SNP by Google. There is no official patch or remediation level stated by AMD in the advisory. Users should monitor AMD's advisory AMD-SB-3034 for any future updates or official fixes.