--- id: "TECH-202611-t4ntnt" page: "https://infrastack.ai/live/TECH-202611-t4ntnt" kind: "technique" aliases: [] title: "Mior and Skyfall: a malicious cloud host can read secrets from AMD SEV-SNP confidential VMs, and Mior can fake attestation reports (ETH Zurich, Google; fix is in host firmware)" severity: "medium" cvss: null epss: null exploited: false status: "open" category: "infrastructure" products: [{"name": "AMD SEV-SNP", "fixed": ["SEV firmware 1.3A.03 (7003)", "1.3A.4 (8004/9004)", "1.3A.0A (8005/9005)"], "affected": "EPYC 7003, 8004, 8005, 9004, 9005 without the Aug 2026 SEV firmware/microcode and platform firmware", "ecosystem": "vendor"}, {"name": "AMD EPYC", "fixed": ["MilanPI-SP3_1.0.0.L", "GenoaPI_1.0.0.K", "Genoa_100J Patch 3", "TurinPI_1.0.0.C"], "affected": "7003 (Zen 3), 8004/9004 (Zen 4), 8005/9005 (Zen 5) server processors", "ecosystem": "vendor"}] ecosystems: [] tags: ["amd", "confidential-computing", "early-warning", "sev-snp", "technique"] not_affected_if: [] published_at: null first_seen_at: "2026-11-13T15:45:23+00:00" updated_at: "2026-11-13T15:46:05+00:00" sources: [{"source": "analyst", "url": "https://thehackernews.com/2026/11/new-mior-and-skyfall-attacks-let-rogue.html", "first_seen_at": "2026-11-13T15:45:23+00:00", "cites": ["https://thehackernews.com/2026/11/new-mior-and-skyfall-attacks-let-rogue.html"]}] exploit_sources: [] --- # Mior and Skyfall: a malicious cloud host can read secrets from AMD SEV-SNP confidential VMs, and Mior can fake attestation reports (ETH Zurich, Google; fix is in host firmware) Link for people: https://infrastack.ai/live/TECH-202611-t4ntnt (this .md is for agents) Two research attacks made public the week of 13 Nov 2026 break AMD SEV-SNP, the confidential-VM protection on AMD EPYC servers that is meant to keep the host operator out. Mior (ETH Zurich, CVE-2026-0462, CVSS 4.0 5.9): during SEV-SNP start-up the attacker redirects the security processor's Reverse Map Table writes to a PCIe device (a graphics card), leaving the table unprotected. The hypervisor can then turn debugging on for a VM that disabled it and read and change its memory (1,000 of 1,000 attempts), and can copy a harmless VM's measurement into a malicious VM so its signed attestation reports look clean. Works with ciphertext hiding on. Needs control of the hypervisor and BIOS/UEFI plus a PCIe device. Tested on EPYC 9135 (Zen 5); Zen 3 and Zen 4 possibly affected, not tested. Skyfall (ETH Zurich and Google, CVE-2026-40671, 4.9): a hypervisor makes a VM fail to start on purpose, then reads the VM's saved state left in the cache through the Transient Scheduler Attacks (TSA) leak. It recovered saved register values and a disk-encryption key; it can read only three fixed cache lines per memory page. Needs a malicious host only, no hardware tampering. Tested on Zen 3 (EPYC 7313) and Zen 4 (EPYC 9124, 9334), not shown on Zen 5. Skyfall also leaks SMM register values (CVE-2026-18448, EDK II, 5.6). Both teams published proof-of-concept code. Attacks in the wild: none reported. Only matters if you rely on SEV-SNP to protect VMs from the host or cloud provider; ordinary VMs already trust the host. Renters of confidential VMs cannot patch: the fix is in host firmware. Which cloud providers have patched: unknown. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:AMD SEV-SNP affected EPYC 7003, 8004, 8005, 9004, 9005 without the Aug 2026 SEV firmware/microcode and platform firmware fixed SEV firmware 1.3A.03 (7003), 1.3A.4 (8004/9004), 1.3A.0A (8005/9005) - vendor:AMD EPYC affected 7003 (Zen 3), 8004/9004 (Zen 4), 8005/9005 (Zen 5) server processors fixed MilanPI-SP3_1.0.0.L, GenoaPI_1.0.0.K, Genoa_100J Patch 3, TurinPI_1.0.0.C ## How to check - You run or rent AMD SEV-SNP confidential VMs on EPYC 7003, 8004, 8005, 9004 or 9005 servers, or use SNP attestation to decide which VMs to trust. - Own servers: check the SEV firmware and platform BIOS version. Mior is fixed in SEV firmware 1.3A.03 (7003), 1.3A.4 (8004/9004), 1.3A.0A (8005/9005), dated 12 Aug; Skyfall in microcode dated 12 Aug. Platform firmware targets: 7003 MilanPI-SP3_1.0.0.L; 8004/9004 GenoaPI_1.0.0.K (Mior, December) and Genoa_100J Patch 3 (Skyfall, November); 8005/9005 TurinPI_1.0.0.C. Supermicro H12, H13 and H14 boards need both BIOS and BMC updates. - Attestation verifiers: AMD's Mior advisory lists the TCB values for each fixed firmware version. Reports from hosts below those values may come from an unpatched host. - Rented confidential VMs: ask your cloud provider whether the host firmware has the AMD fixes for CVE-2026-0462 and CVE-2026-40671. ## Fix - Own EPYC hosts: install the BIOS/platform firmware with the fixes from your server maker as soon as it ships (Skyfall November, Mior December), plus the 12 Aug SEV firmware and microcode. Embedded EPYC fixes are due January to April 2027, and Instinct MI300A has a Skyfall patch dated 21 Sep. - Raise the minimum TCB/firmware version your attestation policy accepts to the fixed versions. - Cloud customers: get your provider to confirm patched hosts. Until then, do not treat SEV-SNP as protection against a malicious host for your most sensitive keys. - AMD lists no workaround. ## Timeline - 2026-11-13T15:45:23+00:00 analyst https://thehackernews.com/2026/11/new-mior-and-skyfall-attacks-let-rogue.html ## Documents - [describes] @TheHackersNews: 🚨 Two new attacks break AMD's confidential VM protections. Dubbed 'Mior' and 'S https://x.com/TheHackersNews/status/2121264146390122799 - [describes] @TheHackersNews: Mior let researchers turn debugging back on inside a VM that had explicitly disa https://x.com/TheHackersNews/status/2121266677992374343 - [describes] @TheHackersNews: A failed VM startup can leave secrets behind in the processor. Skyfall exploits https://x.com/TheHackersNews/status/2121266561306738773 - [describes] @TheHackersNews: Cloud customers cannot patch these VM security flaws themselves. Fixes for Mior https://x.com/TheHackersNews/status/2121266182242324769 - [describes] New Mior and Skyfall Attacks Let Rogue Cloud Hosts Steal Secrets From AMD SEV-SNP VMs https://thehackernews.com/2026/11/new-mior-and-skyfall-attacks-let-rogue.html --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_