AMD SEV-SNP - VM_HSAVE_PA MSR validation: MULTI-TENANT ISOLATION: Insufficient validation of the VM_HSAVE_PA

Impact

MULTI-TENANT ISOLATION: Insufficient validation of the VM_HSAVE_PA model-specific register lets a malicious hypervisor point the host-state save area somewhere it should not be, breaking SEV-SNP guest memory integrity. The RMP is supposed to make it impossible for the host to write guest pages; this is a way around that using an MSR the host legitimately controls.

Who can reach it

Requires host/hypervisor privilege - the SEV-SNP adversary model exactly. No guest cooperation needed.

What to do

Fixed in AMD SEV firmware / AGESA and reaches you as an OEM SBIOS package - AMD hands AGESA to Dell, HPE, Supermicro, Lenovo and the ODMs, who each requalify before shipping BIOS. **Budget one to six months of OEM lag**, longer on older platforms and sometimes never on end-of-support SKUs. Applying it means draining the host and doing a full power cycle. Because the fix moves the platform's reported SEV-SNP TCB version, you must also pull fresh VCEK certificates from AMD's Key Distribution Service and update any attestation policy your tenants pin - otherwise guests will start failing launch validation the moment the BIOS lands. Some SEV firmware can alternatively be staged from linux-firmware (amd/amd_sev_*.sbin) and committed via the ccp driver at boot, which is faster than waiting on BIOS - check whether your platform supports firmware hot-load before assuming the OEM is the only route.

References