Skip to main content

AMD EPYC Processors EUVDEUVD-2025-209811

| CVE-2025-61971 MEDIUM
Security-Sensitive Hardware Controls with Missing Lock Bit Protection (CWE-1233)
2026-05-13 AMD
Information Disclosure Amd Epyc 9004 Series Processors Amd Epyc 7003 Series Processors Amd Epyc 9005 Series Processors Amd Epyc 8004 Series Processors Amd Epyc Embedded 7003 Series Processors Amd Epyc Embedded 9004 Series Processors Formerly Codenamed Genoa Amd Epyc Embedded 9004 Series Processors Formerly Codenamed Bergamo Amd Epyc Embedded 8004 Series Processors Amd Epyc Embedded 9005 Series Processors
5.9
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.9 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.0 MEDIUM

Local admin access required to write NBIO registers; scope changes to SEV-SNP guest VMs with high integrity impact; no confidentiality or availability impact on either system.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N
SUSE
6.0 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Red Hat
6.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Jul 23, 2026 - 19:01 vuln.today
CVE Published
May 13, 2026 - 03:02 nvd
UNKNOWN (no severity yet)
CVE Published
May 13, 2026 - 03:02 cve.org
MEDIUM 5.9

DescriptionCVE.org

Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to modify MMIO routing configurations, potentially resulting in loss of SEV-SNP guest integrity.

AnalysisAI

Missing hardware lock bit protection on NBIO registers in AMD EPYC server processors (7003/8004/9004/9005 series, including embedded variants) allows a local admin-privileged attacker to reconfigure MMIO routing, undermining SEV-SNP guest integrity guarantees. The vulnerability is significant in confidential computing contexts where SEV-SNP is deployed to protect tenant workloads from potentially malicious host operators - precisely the trust boundary AMD's hardware security feature is designed to enforce. No public exploit exists and EPSS (0.01%, 2nd percentile) combined with SSVC exploitation status of 'none' indicate negligible near-term mass exploitation risk; however, targeted abuse by privileged insiders or compromised hypervisor hosts is the realistic concern.

Technical ContextAI

The NBIO (North Bridge I/O) is the die-to-die and CPU-to-peripheral interconnect fabric controller embedded in AMD EPYC processors, responsible for arbitrating and routing MMIO (Memory-Mapped I/O) transactions between processor dies and PCIe/peripheral devices. CWE-1233 (Improper Hardware Lock Protection for Security Sensitive Controls) describes flaws where hardware registers governing security-sensitive behavior should be locked by firmware during boot to prevent later modification but are not. In this case, NBIO registers controlling MMIO routing lack proper lock bit enforcement, allowing a sufficiently privileged local attacker to alter those routing tables post-boot. AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) relies on hardware-enforced memory integrity to guarantee that guest VM pages have not been tampered with by the hypervisor or host OS; subverting MMIO routing at the NBIO level can cause memory transactions attributed to a guest to be redirected, bypassing SEV-SNP's integrity measurement chain. CPE data confirms the flaw spans Milan (EPYC 7003), Genoa/Bergamo (EPYC 9004), Siena (EPYC 8004), Turin (EPYC 9005), and all corresponding embedded variants.

RemediationAI

Vendor-released patches are available for all affected EPYC generations via updated AGESA/PI firmware. Operators should obtain and apply the following PI firmware versions through their OEM or platform firmware update channel: EPYC 9004 Series → GenoaPI_1.0.0.H; EPYC 8004 Series → GenoaPI_1.0.0.H; EPYC 7003 Series → MilanPI-SP3_1.0.0.J; EPYC 9005 Series → TurinPI_1.0.0.8; EPYC Embedded 7003 → EmbMilanPI-SP3 1.0.0.D; EPYC Embedded 8004 → EmbGenoaPI-SP5 1.0.0.D; EPYC Embedded 9004 (Genoa and Bergamo) → EmbGenoaPI-SP5 1.0.0.D; EPYC Embedded 9005 → EmbeddedTurinPI_SP5_1004. Refer to AMD-SB-3030 (https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3030.html) for OEM-specific delivery timelines, as server firmware is typically distributed via system vendors (Dell, HPE, Lenovo, Supermicro). Firmware updates require a system reboot; schedule maintenance windows accordingly. As an interim compensating control where immediate firmware application is not feasible, enforce strict least-privilege controls on hypervisor host administrative accounts, audit MMIO configuration access, and limit host-level access for cloud operators in SEV-SNP deployments - these measures reduce but do not eliminate risk since they rely on OS-layer controls rather than fixing the underlying hardware lock bit deficiency.

More in Amd Epyc 9004 Series Processors

View all
CVE-2025-61972 HIGH
8.5 May 13

Privilege escalation into the AMD Secure Processor affects AMD EPYC 8004/9004/9005 and EPYC Embedded 8004/9004/9005 seri
CVE-2025-54502 HIGH
7.1 Apr 16

Local privilege escalation in the AMD Platform Configuration Blob (APCB) SMM driver, shipped in AGESA firmware across ne
CVE-2025-54510 MEDIUM
5.9 Apr 16

Missing lock check in the AMD Platform Security Processor (PSP) across multiple EPYC server CPU generations enables a lo
CVE-2025-54509 MEDIUM
4.0 Jun 09

Improper access control in the IOMMU register interface on AMD EPYC server processors allows a high-privileged local att

Same weakness CWE-1233 – Security-Sensitive Hardware Controls with Missing Lock Bit Protection

View all
CVE-2025-61972 HIGH
8.5
CVE-2025-25735 MEDIUM POC
4.6
CVE-2025-25733 LOW POC
3.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected

Share

EUVD-2025-209811 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy