Database/Kernel, userspace & hypervisor
AMD SEV-ES (CacheWarp): CacheWarp: INVD lets a malicious hypervisor revert SEV-ES guest memory writes, breaking guest
Impact
CacheWarp: INVD lets a malicious hypervisor revert SEV-ES guest memory writes, breaking guest integrity and enabling auth bypass inside the VM
Who can reach it
Malicious/compromised host against a tenant confidential VM
What to do
Microcode/AGESA update + reboot. Undermines the trust story of any SEV-based confidential GPU-VM offering - must be reflected in attestation policy, not just patching
Fleet impact
How widespread
common - SEV-SNP is the CPU-side TEE that anchors "confidential GPU" offerings on EPYC Naples/Rome/Milan hosts
Cost to remediate
microcode+reboot for Milan; Naples/Rome are effectively unpatchable-mitigate-only, so affected nodes must be retired from any confidential-compute SKU
Why it hits the whole fleet
Breaks the integrity guarantee of confidential VMs from a malicious hypervisor - the exact threat model a neocloud invokes when it tells a customer their weights are safe from the operator.
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.