AMD SEV firmware - RMP write during SNP initialization: MULTI-TENANT ISOLATION: A privileged attacker can write

Impact

MULTI-TENANT ISOLATION: A privileged attacker can write to the reverse map page during secure nested paging initialization, corrupting the ownership map before any guest launches. Because the RMP is initialised once and then trusted, poisoning it at init time means every guest that subsequently launches on that host inherits a compromised isolation boundary.

Who can reach it

Local, privileged, during SNP init - so an attacker who controls the host's boot or SNP initialisation path.

What to do

Fixed in AMD reference firmware (AGESA / PSP / SEV firmware) and delivered only as an OEM SBIOS/BIOS package - Dell, HPE, Supermicro, Lenovo and the ODMs each rebuild and requalify AMD's AGESA drop before shipping. **Expect one to six months of OEM lag**, and on end-of-support platforms expect nothing. Applying it is a drain plus full power cycle, not a driver reload. Verify by reading back the PSP/SMU firmware version afterwards rather than trusting the BIOS version string. This sits inside the SEV-SNP trust boundary, so the update moves the platform's reported TCB version: refresh VCEK certificates from AMD's KDS and update any attestation policy your tenants pin, or confidential guest launches will start failing right after the BIOS lands. Pair with host measured boot: if you cannot attest the boot sequence, you cannot rule out that SNP was initialised under an attacker's influence.

References