CWE-1233 vulnerabilities

CVE-2025-61972 is a high-severity vulnerability affecting AMD EPYC™ 9004 Series Processors. It involves missing lock bit protection for NBIO registers, which could allow a local attacker with administrative privileges to gain arbitrary access to the System Management Network (SMN). This access may lead to arbitrary code execution within the AMD Secure Processor (ASP) and compromise the confidentiality and integrity of SEV-SNP guests. The vulnerability has a CVSS 4.0 score of 8.5, indicating a significant security risk. No official patch or remediation guidance has been provided by AMD at this time. There are no known exploits in the wild currently reported. The vulnerability requires high attack complexity and local privileges, with no user interaction needed. The impact includes potential loss of security guarantees for virtualized environments relying on SEV-SNP protections.

CVE-2025-61971 is a vulnerability in AMD EPYC 9004 Series Processors involving missing lock bit protection for NBIO registers. This flaw allows a local attacker with administrative privileges to modify MMIO routing configurations. Such modifications could compromise the integrity of SEV-SNP guests. The vulnerability has a medium severity rating with a CVSS score of 5.9. No public exploits or known active exploitation have been reported. No patch or remediation information is currently available.