AMD Secure Processor firmware - BIOS mailbox command bounds checking: MULTI-TENANT ISOLATION: Insufficient bounds

Impact

MULTI-TENANT ISOLATION: Insufficient bounds checking while the ASP firmware handles BIOS mailbox commands lets an attacker write partially-controlled data out of bounds into SMM or SEV-protected memory. Both destinations are places the OS is explicitly not allowed to reach: SMM is the most privileged execution mode on x86, and SEV memory belongs to confidential guests.

Who can reach it

Local, via the BIOS mailbox interface - requires host privilege.

What to do

Fixed in AMD reference firmware (AGESA / PSP / SEV firmware) and delivered only as an OEM SBIOS/BIOS package - Dell, HPE, Supermicro, Lenovo and the ODMs each rebuild and requalify AMD's AGESA drop before shipping. **Expect one to six months of OEM lag**, and on end-of-support platforms expect nothing. Applying it is a drain plus full power cycle, not a driver reload. Verify by reading back the PSP/SMU firmware version afterwards rather than trusting the BIOS version string. This sits inside the SEV-SNP trust boundary, so the update moves the platform's reported TCB version: refresh VCEK certificates from AMD's KDS and update any attestation policy your tenants pin, or confidential guest launches will start failing right after the BIOS lands.

References