Mior and Skyfall: a malicious cloud host can read secrets from AMD SEV-SNP confidential VMs, and Mior can fake attestation reports (ETH Zurich, Google; fix is in host firmware)

Two research attacks made public the week of 13 Nov 2026 break AMD SEV-SNP, the confidential-VM protection on AMD EPYC servers that is meant to keep the host operator out. Mior (ETH Zurich, CVE-2026-0462, CVSS 4.0 5.9): during SEV-SNP start-up the attacker redirects the security processor's Reverse Map Table writes to a PCIe device (a graphics card), leaving the table unprotected. The hypervisor can then turn debugging on for a VM that disabled it and read and change its memory (1,000 of 1,000 attempts), and can copy a harmless VM's measurement into a malicious VM so its signed attestation reports look clean. Works with ciphertext hiding on. Needs control of the hypervisor and BIOS/UEFI plus a PCIe device. Tested on EPYC 9135 (Zen 5); Zen 3 and Zen 4 possibly affected, not tested. Skyfall (ETH Zurich and Google, CVE-2026-40671, 4.9): a hypervisor makes a VM fail to start on purpose, then reads the VM's saved state left in the cache through the Transient Scheduler Attacks (TSA) leak. It recovered saved register values and a disk-encryption key; it can read only three fixed cache lines per memory page. Needs a malicious host only, no hardware tampering. Tested on Zen 3 (EPYC 7313) and Zen 4 (EPYC 9124, 9334), not shown on Zen 5. Skyfall also leaks SMM register values (CVE-2026-18448, EDK II, 5.6). Both teams published proof-of-concept code. Attacks in the wild: none reported. Only matters if you rely on SEV-SNP to protect VMs from the host or cloud provider; ordinary VMs already trust the host. Renters of confidential VMs cannot patch: the fix is in host firmware. Which cloud providers have patched: unknown.