CVE-2025-61972

Summary

Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to gain arbitrary System Management Network (SMN) access, potentially resulting in arbitrary code execution in AMD Secure Processor (ASP) and loss of the SEV-SNP guest's confidentiality and integrity.

Affected Software

VendorProductVersion RangeStatus
AMDAMD EPYC™ 9004 Series ProcessorsGenoaPI_1.0.0.Hunaffected
AMDAMD EPYC™ 9005 Series ProcessorsTurinPI_1.0.0.8unaffected
AMDAMD EPYC™ 8004 Series ProcessorsGenoaPI_1.0.0.Hunaffected
AMDAMD EPYC™ Embedded 9004 Series Processors (formerly codenamed “Genoa”)EmbGenoaPI-SP5 1.0.0.Dunaffected
AMDAMD EPYC™ Embedded 9004 Series Processors (formerly codenamed “Bergamo”)EmbGenoaPI-SP5 1.0.0.Dunaffected
AMDAMD EPYC™ Embedded 8004 Series ProcessorsEmbGenoaPI-SP5 1.0.0.Dunaffected
AMDAMD EPYC™ Embedded 9005 Series ProcessorsEmbeddedTurinPI_SP5_1004unaffected

Weaknesses

  • CWE-1233: CWE-1233 Security-Sensitive Hardware Controls with Missing Lock Bit Protection

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References