Mior and Skyfall expose flaws in AMD SEV‑SNP that allow data theft in VMs
Researchers from ETH Zurich and Google demonstrated two vulnerabilities – Mior and Skyfall – that allow a compromised host to read and modify memory of VMs protected by AMD SEV‑SNP.
Researchers from ETH Zurich, in partnership with Google, revealed two vulnerabilities that allow a malicious host to read and, in the case of Mior, modify data inside virtual machines (VMs) protected by AMD SEV‑SNP. The attacks, named Mior and Skyfall, were demonstrated in labs using AMD EPYC processors.
Both flaws require full hypervisor control; Mior additionally requires access to the BIOS/UEFI and the presence of a PCIe device, such as a graphics card, to redirect internal processor operations.
Mior: compromise of the Reverse Map Table (RMP) during initialization
During the boot phase, the Platform Security Processor (PSP) populates the Reverse Map Table (RMP), which records ownership and permissions for each memory page. The researchers redirected the PSP's writes to the memory of a controlled graphics card instead of main memory. Since the PSP reads back the written values, the card returned the expected data, allowing initialization to complete without errors while leaving part of the RMP uninitialized.
With the RMP vulnerable, the hypervisor was able to rewrite table protections, enable debugging in a confidential VM, and use PSP debug commands to read and write VM memory. The experiment was successful in all 1,000 attempts performed.
{"after":4,"prompt":"A schematic illustration showing the PSP writing to a graphics card’s memory instead of main RAM, highlighting the redirected write path and the uninitialized RMP entry.","alt":"Illustration of PSP write redirection to graphics card memory, leaving the RMP vulnerable"}
In addition to reading memory, Mior allows forging the signed report that proves which software is running in the VM. The researchers copied the measurement of an innocent VM to a malicious VM, causing the attestation report to describe the correct image even though the VM was compromised.
The attack was tested on an EPYC 9135 (Zen 5). The authors believe that Zen 3 and Zen 4 chips may be affected, although they did not run tests on those models due to BIOS limitations.
Skyfall: leakage of registers and keys via Transient Scheduler Attacks (TSA)
Skyfall is based on previously disclosed flaws known as Transient Scheduler Attacks, which allow data leakage via instruction timing. The researchers caused deliberate faults during VM initialization; the processor had already stored part of the VM's state in cache, which was not properly cleared.
By reading this cache, the hypervisor recovered register values and even the disk encryption key of a test VM. To extract the key, the VM code was paused precisely when the key was in registers. In real-world scenarios, the attack could use the SEV‑Step technique to step the VM forward until the key was loaded.
Skyfall also allows reading three fixed cache lines (offsets 0x0c0, 0x380, and 0x3c0) within a target memory page, but not the rest of the page.
The experiment was conducted on EPYC 7313 (Zen 3) and Zen 4 EPYC 9124 and 9334 chips; no leakage was observed in Zen 5.
In addition to VM memory, the team read decrypted microcode and register values stored in System Management Mode (SMM) memory, which are normally inaccessible to the operating system.
Impact, CVEs, and fixes
AMD registered Mior as CVE‑2026‑0462, with a CVSS 4.0 score of 5.9, and Skyfall as CVE‑2026‑40671, with a score of 4.9. Both vulnerabilities affect only the SEV‑SNP variant; previous versions (SEV, SEV‑ES) are not impacted.
The company released platform firmware for the EPYC 7003, 8004, 8005, 9004, and 9005 series, with releases scheduled for November (Skyfall) and December (Mior) 2026. Microcode updates for Skyfall have already been released, and AMD recommends that customers apply the BIOS updates provided by server manufacturers.
Manufacturers such as Supermicro have published lists of BIOS and BMC versions that fix the flaws on various motherboards (H12, H13, H14). As the fixes are implemented in host firmware, users of confidential cloud VMs depend on providers to apply the updates.
To date, there is no public evidence of exploitation in the wild. The PoC source code was made available by the authors, but requires a modified BIOS to leave memory routing settings unlocked.
What to do
Verify that platform firmware and microcode corresponding to the listed EPYC series have been updated according to AMD advisories.
Apply BIOS updates provided by the server manufacturer as soon as possible.
Review hypervisor trust policies and ensure that only signed and audited software is executed.
Monitor VM boot logs and unexpected debug events.
Consider disabling optional features like “ciphertext hiding” if they are not needed, although this reduces protection against memory reads.
CyberX Technical Analysis
Mior – RMP exploitation
The attack manipulates the PSP write path, redirecting it to the memory of a controlled PCIe device. This leaves the RMP entry protecting the table itself uninitialized, allowing the hypervisor to overwrite page permissions and enable debugging via internal PSP commands. The need for a modified BIOS indicates that the attacker must have firmware control prior to boot.
Skyfall – leakage via residual cache
By forcing a VM initialization fault, the processor leaves part of the VM state in cache. The hypervisor, using high-frequency performance counting instructions, reads these values before hardware clears them. The attack does not require firmware modifications, only hypervisor privileges and access to performance counters.
Comparison and mitigation
Prerequisites: Mior requires BIOS/UEFI control and a PCIe device; Skyfall requires only hypervisor control.
Read scope: Mior allows arbitrary memory read and write; Skyfall is limited to three cache lines per page, but can extract register keys.
Mitigations: Firmware/BIOS updates fix the PSP write logic and insert RMP integrity checks. For Skyfall, the primary mitigation is applying microcode patches that clear residual cache and disabling performance counters in production environments.
Threat Summary
Vulnerabilities Mior (CVE‑2026‑0462) and Skyfall (CVE‑2026‑40671) allow a compromised hypervisor to read or modify data of VMs protected by AMD SEV‑SNP. Mior requires a modified BIOS and a PCIe device; Skyfall relies only on hypervisor control.
Potentially affected assets
AMD EPYC servers from the 7003, 8004, 8005, 9004, and 9005 series running SEV‑SNP.
Cloud environments offering confidential VMs based on SEV‑SNP.
Server motherboards that have not yet received the BIOS updates listed by AMD or the manufacturers (e.g., Supermicro H12/H13/H14).
Indicators of Compromise (IOCs)
So far there are no publicly confirmed IOCs in real attacks. The PoCs use PSP debug instructions and performance counter reads; monitoring unusual calls to these interfaces may indicate exploitation.
Immediate Recommendations
Apply the platform firmware and microcode updates released by AMD for the affected EPYC lines.
Install the BIOS/BMC updates provided by server manufacturers.
Restrict hypervisor access to trusted administrators and enable firmware change auditing.
Disable high-resolution performance counters in production if not required.
Long‑Term Actions
Implement firmware integrity verification processes (TPM, Secure Boot) before deployment.
Monitor AMD and server vendor security advisories for new updates.
Consider adopting confidential computing solutions that support multiple verification layers (e.g., additional hardware-based attestation).
Evidence Preservation
In case of suspicion, capture VM boot logs, PSP debug logs, and performance counters. Preserve firmware images before updating for forensic analysis.
Frequently Asked Questions
Which processors are affected by the Mior and Skyfall vulnerabilities?
The Mior attack was tested on EPYC 9135 (Zen 5) and may affect Zen 3 and Zen 4. Skyfall was observed on EPYC 7313 (Zen 3) and Zen 4 chips, but not on Zen 5.
How does the Mior flaw compromise VM security?
Mior redirects PSP writes to the memory of a graphics card, leaving the Reverse Map Table vulnerable, which allows the hypervisor to enable debugging and read/write the VM memory.
What is required to exploit the Skyfall flaw?
Exploiting Skyfall requires full hypervisor control and access to high-frequency performance counters, without the need for firmware changes.
When will patches for these vulnerabilities be released?
AMD expects to release the fix firmware for Skyfall in November 2026 and for Mior in December 2026.
