Skip to content
CVE PROGRAM SOURCE RECORD4.6 Medium

CVE-2025-48517

Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID in the range meant for SE

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
AMD

Description

Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID in the range meant for SEV-SNP guests potentially resulting in a partial loss of confidentiality.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

AMD AMD EPYC™ 9005 Series Processors

Default version status: affected

  • TurinPI 1.0.0.6unaffected

AMD AMD EPYC™ Embedded 9005 Series Processors

Default version status: affected

  • EmbTurinPI-SP5_1.0.0.1unaffected

References