Skip to content
CVE PROGRAM SOURCE RECORD4.0 Medium

CVE-2025-48514

Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, potentially resulting in a loss of confiden

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
AMD

Description

Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, potentially resulting in a loss of confidentiality.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

AMD AMD EPYC™ 9004 Series Processors

Default version status: affected

  • Genoa++_1.0.0.Hunaffected

AMD AMD EPYC™ 7003 Series Processors

Default version status: affected

  • MilanPI 1.0.0.Hunaffected

AMD AMD EPYC™ 9005 Series Processors

Default version status: affected

  • TurinPI 1.0.0.6unaffected

AMD AMD EPYC™ 8004 Series Processors

Default version status: affected

  • Genoa++_1.0.0.Hunaffected

AMD AMD EPYC™ Embedded 7003 Series Processors

Default version status: affected

  • EmbMilanPI-SP3 v9 1.0.0.Cunaffected

AMD AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa")

Default version status: affected

  • EmbGenoaPI-SP5 1.0.0.Cunaffected

AMD AMD EPYC™ Embedded 9005 Series Processors

Default version status: affected

  • EmbTurinPI-SP5_1.0.0.1unaffected

AMD AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Bergamo")

Default version status: affected

  • EmbGenoaPI-SP5 1.0.0.Cunaffected

AMD AMD EPYC™ Embedded 8004 Series Processors

Default version status: affected

  • EmbGenoaPI-SP5 1.0.0.Cunaffected

References