AMD Secure Processor kernel - DRAM mapping into protected areas (AMD-SB-3003): An access-control gap in the ASP kernel

Impact

An access-control gap in the ASP kernel allows DRAM to be mapped into areas the secure processor treats as protected. Mapping attacker-influenced DRAM into a protected region is how you get the secure processor to operate on data it believes is trustworthy - low score, but it is a building block rather than an endpoint.

Who can reach it

Local, privileged, through the ASP interface.

What to do

Fixed in AMD PI/AGESA firmware and delivered only as an OEM SBIOS package - AMD ships the PI drop to Dell, HPE, Supermicro, Lenovo and the ODMs, who each requalify before releasing BIOS. **Budget one to six months of OEM lag**, and note that several CVEs in this batch are marked 'no fix planned' on Naples (EPYC 7001) - for those the only remediation is retiring the hardware. Applying it means cordon, drain and a full power cycle per node; there is no driver reload, no live patch and no VBIOS step. Marked 'no fix planned' on Naples (EPYC 7001) - on that generation the remediation is hardware retirement, which for 2017-era EPYC in an AI fleet is likely already overdue on performance grounds.

References