EUVD-2025-209846
GHSA-2q25-77f5-pmx5
CVSS VectorNVD
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionNVD
Improper privilege management in the KVM key download component could allow an attacker to swap tokens and download sensitive keys, potentially resulting in unauthorized access to privileged resources and loss of confidentiality.
AnalysisAI
Improper privilege management in AMD's KVM key download component allows authenticated local attackers to swap tokens and exfiltrate sensitive cryptographic keys due to insufficient access controls, potentially enabling unauthorized access to privileged resources and compromising system confidentiality. The vulnerability requires authenticated access (PR:L) but carries high confidentiality impact (VC:H), making it a significant risk in multi-tenant or shared-access environments.
Technical ContextAI
The KVM key download component is part of AMD's virtualization infrastructure, responsible for securely provisioning cryptographic keys to virtual machines. The vulnerability stems from CWE-269 (Improper Handling of Privileges), specifically a failure to properly enforce privilege boundaries when validating token authenticity during key download operations. Attackers with local authenticated access can manipulate or swap authentication tokens, allowing them to download keys intended for other users or VMs, compromising the confidentiality of sensitive key material that should be access-restricted.
RemediationAI
Apply the security update provided by AMD in Security Bulletin AMD-SB-9023 (https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-9023.html), which addresses the improper privilege management issue in the KVM key download component. If immediate patching is not feasible, implement network and local access controls to restrict authenticated users who can access the KVM key download functionality; limit key download requests to defined service accounts and audit all token-based authentication events. Disable or isolate KVM key download functionality in lower-security environments if the feature is not essential. Verify that privilege escalation vectors through token swapping are not available in your deployment by testing privilege boundaries in non-production systems before patching.
Share
External POC / Exploit Code
Leaving vuln.today