AMD SEV-SNP firmware - input validation: MULTI-TENANT ISOLATION: Improper input validation in SEV-SNP lets a malicious

Impact

MULTI-TENANT ISOLATION: Improper input validation in SEV-SNP lets a malicious hypervisor read or overwrite guest memory. That is the whole point of SEV-SNP defeated in one line: the host, which SNP exists to exclude, gets both read and write access to the confidential guest's pages.

Who can reach it

Malicious or compromised hypervisor. The guest need do nothing.

What to do

Fixed in AMD SEV firmware / AGESA and reaches you as an OEM SBIOS package - AMD hands AGESA to Dell, HPE, Supermicro, Lenovo and the ODMs, who each requalify before shipping BIOS. **Budget one to six months of OEM lag**, longer on older platforms and sometimes never on end-of-support SKUs. Applying it means draining the host and doing a full power cycle. Because the fix moves the platform's reported SEV-SNP TCB version, you must also pull fresh VCEK certificates from AMD's Key Distribution Service and update any attestation policy your tenants pin - otherwise guests will start failing launch validation the moment the BIOS lands. Some SEV firmware can alternatively be staged from linux-firmware (amd/amd_sev_*.sbin) and committed via the ccp driver at boot, which is faster than waiting on BIOS - check whether your platform supports firmware hot-load before assuming the OEM is the only route.

References