Search: CVE-2025-61971

CVE-2025-61971 is a vulnerability in AMD EPYC 9004 Series Processors involving missing lock bit protection for NBIO registers. This flaw allows a local attacker with administrative privileges to modify MMIO routing configurations. Such modifications could compromise the integrity of SEV-SNP guests. The vulnerability has a medium severity rating with a CVSS score of 5.9. No public exploits or known active exploitation have been reported. No patch or remediation information is currently available.

A vulnerability in AMD firmware allows a malicious hypervisor to execute arbitrary code on the AMD Secure Processor (ASP), escalating Memory Mapped I/O (MMIO) read and write permissions. This compromises the confidentiality and integrity of SEV-SNP guests. Google has applied mitigations to Confidential VM instances with AMD SEV-SNP, and no customer action is required.