AMD Power Management Firmware (PMFW) - unintended proxy to the System Management Unit: MULTI-TENANT ISOLATION: The GPU

Impact

MULTI-TENANT ISOLATION: The GPU power management firmware acts as an unintended proxy, letting a privileged attacker relay malformed messages through to the System Management Unit. The SMU is the always-on microcontroller that governs clocks, voltages and power limits across the platform; getting arbitrary messages to it through the GPU firmware path means the GPU stack becomes a route into platform-level control. It is the confused-deputy pattern applied to firmware: PMFW is trusted by the SMU, so whoever controls PMFW inherits that trust.

Who can reach it

Local, privileged attacker able to send messages to the GPU power management firmware.

What to do

Fixed in AMD GPU firmware, which on Instinct parts is delivered as a firmware bundle through the ROCm/amdgpu driver package (the PSP loads the signed blobs at driver init) rather than through the server BIOS. Practically: update the AMD GPU driver/firmware package, then **drain the node and reboot** - the firmware is loaded once at driver init, so a reload of the module with no process holding /dev/kfd is the minimum, and a reboot is what you will actually schedule. Some fixes at this layer also require a **GPU VBIOS flash** via AMD's amdvbflash/amdfwtool, which is an offline, per-card operation with real bricking risk - check the AMD bulletin for whether a VBIOS update is called out before assuming a driver package covers it.

References