AMD EPYC 7001 · CVE-2025-0008 · Infrastructure
FIX → NaplesPI-SP3_1.0.0.T · RomePI-SP3_1.0.0.Q · MilanPI 1.0.0.G · SnowyOwl_SP4_SP4r2.1.1.0.I +2 ✓ verified
AMD-SB-3049: the SDU authorization key provisioned in the BIOS is insufficiently validated and may be modified. An attacker with Ring 0 privileges can bypass debug access protections. CVSS 4.0 8.4. AMD lists EPYC 7001/7002/7003 and EPYC Embedded 3000/7002/7003. No exploitation or PoC is mentioned; AMD says it found this internally.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Servers and embedded systems on the AMD EPYC 7001, 7002, 7003 and EPYC Embedded 3000, 7002, 7003 series are listed by AMD. The attacker needs Ring 0 (kernel-level) privileges on the machine, so the risk is mainly to bare-metal hosts where an attacker has already gained root. Cloud customers on managed VMs can leave it to the provider.
Not affected if managed-hosting
amd, bios, epyc, firmware, hardware, secure-debug
Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU), potentially resulting in unauthorized debug access.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to NaplesPI-SP3_1.0.0.T · RomePI-SP3_1.0.0.Q · MilanPI 1.0.0.G · SnowyOwl_SP4_SP4r2.1.1.0.I +2
Install a BIOS from your server/board vendor that includes AMD's mitigated PI: EPYC 7001 NaplesPI-SP3_1.0.0.T; 7002 RomePI-SP3_1.0.0.Q; 7003 MilanPI 1.0.0.G; Embedded 3000 SnowyOwl_SP4_SP4r2.1.1.0.I; Embedded 7002 EmbeddedRomePI-SP3 1.0.0.G; Embedded 7003 EmbMilanPI-SP3 1.0.0.B.