EUVD-2025-209873
GHSA-f3qw-fm2w-5856
CVSS VectorNVD
CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionNVD
Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with physical access to read or overwrite the contents of cross-chip debug (XCD) registers potentially resulting in loss of data integrity or confidentiality.
AnalysisAI
Improper access control between JTAG and AXI interfaces in AMD Ryzen 7040, 8000, 8040 mobile, and Embedded 8000 series processors allows attackers with physical access to read or modify cross-chip debug (XCD) registers, potentially compromising data integrity and confidentiality. The vulnerability requires physical proximity and specialized hardware capability but can bypass authentication mechanisms protecting debug interfaces. No public exploit code or active exploitation has been identified at the time of analysis.
Technical ContextAI
AMD Ryzen processors contain JTAG (Joint Test Action Group) debug interfaces and AXI (Advanced eXtensible Interface) bus protocols used for processor debugging and internal communication. Cross-chip debug (XCD) registers control access to sensitive processor state and memory. CWE-284 (Improper Access Control) indicates insufficient enforcement of authentication or privilege boundaries between the JTAG test interface and the AXI system bus. The vulnerability suggests that JTAG access can bypass intended security controls on AXI-connected debug registers, allowing unauthorized read and write operations to XCD registers that should be protected. This is a hardware-level vulnerability affecting the processor's debug interface implementation.
RemediationAI
Apply AMD-released microcode and BIOS/firmware updates referenced in AMD security bulletins AMD-SB-4017 and AMD-SB-6027 to disable or restrict JTAG access to XCD registers. For immediate mitigation without patching: physically secure devices against unauthorized access (lock chassis, restrict lab/physical access), disable or password-protect BIOS debug features if supported by firmware, and implement organizational controls to prevent unauthorized possession or disassembly (chain of custody, tamper-evident seals). Organizations must obtain and deploy the specific patched BIOS/microcode versions from their OEM (Dell, HP, Lenovo, etc.) or directly from AMD, as fixes are typically delivered through manufacturer channels rather than direct AMD downloads. Verify patch deployment through BIOS version checks or AMD microcode version tools. Note that firmware updates may require system reboot and should be tested in non-production environments first.
Share
External POC / Exploit Code
Leaving vuln.today