CVE-2025-54510

Summary

A missing lock verification in AMD Secure Processor (ASP) firmware may permit a locally authenticated attacker with administrative privileges to alter MMIO routing on some Zen 5-based products, potentially compromising guest system integrity.

Affected Software

VendorProductVersion RangeStatus
AMDAMD EPYC™ 9004 Series ProcessorsGenoaPI_1.0.0.Hunaffected
AMDAMD EPYC™ 7003 Series ProcessorsMilanPI-SP3_1.0.0.Junaffected
AMDAMD EPYC™ 9005 Series ProcessorsTurinPI_1.0.0.8unaffected
AMDAMD EPYC™ 8004 Series ProcessorsGenoaPI_1.0.0.Hunaffected
AMDAMD EPYC™ Embedded 7003 Series ProcessorsEmbMilanPI-SP3 1.0.0.Dunaffected
AMDAMD EPYC™ Embedded 9004 Series ProcessorsEmbGenoaPI-SP5 1.0.0.Dunaffected
AMDAMD EPYC™ Embedded 9004 Series ProcessorsEmbGenoaPI-SP5 1.0.0.Dunaffected
AMDAMD EPYC™ Embedded 8004 Series ProcessorsEmbGenoaPI-SP5 1.0.0.Dunaffected
AMDAMD EPYC™ Embedded 9005 Series ProcessorsEmbeddedTurinPI_SP5_1004unaffected

Weaknesses

  • CWE-414: CWE-414 Missing Lock Check

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References