Search: CVE-2025-61972

CVE-2025-61972 is a high-severity vulnerability affecting AMD EPYC™ 9004 Series Processors. It involves missing lock bit protection for NBIO registers, which could allow a local attacker with administrative privileges to gain arbitrary access to the System Management Network (SMN). This access may lead to arbitrary code execution within the AMD Secure Processor (ASP) and compromise the confidentiality and integrity of SEV-SNP guests. The vulnerability has a CVSS 4.0 score of 8.5, indicating a significant security risk. No official patch or remediation guidance has been provided by AMD at this time. There are no known exploits in the wild currently reported. The vulnerability requires high attack complexity and local privileges, with no user interaction needed. The impact includes potential loss of security guarantees for virtualized environments relying on SEV-SNP protections.

A vulnerability in AMD firmware allows a malicious hypervisor to execute arbitrary code on the AMD Secure Processor (ASP), escalating Memory Mapped I/O (MMIO) read and write permissions. This compromises the confidentiality and integrity of SEV-SNP guests. Google has applied mitigations to Confidential VM instances with AMD SEV-SNP, and no customer action is required.