Researchers from ETH Zurich and Google have disclosed two attacks, named Mior and Skyfall, that can undermine protections for virtual machines running AMD’s Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP).
In laboratory tests, the attacks allowed a malicious host to recover data from confidential VMs, while Mior also enabled memory changes and forged attestation reports. Both attacks require control of the host hypervisor, so the findings are especially relevant to cloud providers and customers relying on AMD EPYC-based confidential computing rather than ordinary remote attackers.
The ETH Zurich team behind the Mior research paper showed how a compromised host can interfere with SEV-SNP initialization. The attack redirects writes from AMD’s Platform Security Processor to an attacker-controlled PCIe device instead of system memory, leaving parts of the Reverse Map Table uninitialized. That table enforces memory ownership and access controls for confidential VMs. By altering its protections, the hypervisor can read or modify guest memory and make a malicious VM produce an attestation report that describes a different, harmless software image. The researchers demonstrated Mior on an EPYC 9135 Zen 5 processor and said Zen 3 and Zen 4 systems may also be affected, although they did not test those generations. The demonstration requires control of the hypervisor and BIOS or UEFI, along with a controllable PCIe device.
Skyfall, developed by researchers from ETH Zurich and Google, uses a different weakness in AMD’s transient-scheduler side-channel protections. When a hypervisor forces a VM startup attempt to fail, some saved processor state can remain in a cache long enough to be recovered. The team extracted register values and a disk-encryption key from a test SEV-SNP virtual machine, and also demonstrated access to three specific cache lines in a targeted memory page. Tests used AMD EPYC 7313 processors based on Zen 3 and EPYC 9124 and 9334 processors based on Zen 4; the researchers did not demonstrate the VM data leak on Zen 5. The Skyfall paper also records a review committee’s warning that a practical end-to-end attack would require demanding conditions, including an isolated CPU core, repeated failed VM starts and high-frequency performance-counter reads, without VM crashes or timeouts.
AMD tracks Mior as CVE-2026-0462, with a CVSS 4.0 score of 5.9, and Skyfall’s VM data leak as CVE-2026-40671, scored 4.9. AMD’s Mior advisory lists SEV-SNP as affected but does not list the earlier SEV or SEV-ES versions. The Skyfall advisory lists EPYC 7003, 8004, 8005, 9004 and 9005 processor series. For Skyfall, AMD lists platform firmware packages MilanPI-SP3_1.0.0.L, Genoa_100J Patch 3 and TurinPI_1.0.0.C, with target releases in November. The corresponding Mior platform packages are MilanPI-SP3_1.0.0.L, GenoaPI_1.0.0.K and TurinPI_1.0.0.C, targeted for December. AMD also lists SEV firmware versions 1.3A.03, 1.3A.4 and 1.3A.0A for Mior, dated August 12, and a Skyfall patch for the Instinct MI300A accelerator, version 0x0A900110, dated September 21. The new findings are separate from the earlier AMD microcode flaw that also threatened SEV-SNP protections.
Neither AMD advisory reports exploitation of these flaws in the wild. Both research teams have released proof-of-concept code, although the Mior demonstration depends on a BIOS configuration that leaves memory-routing settings unlocked. Because the fixes involve host firmware, customers renting confidential VMs depend on their cloud providers and server manufacturers to deploy the relevant updates.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
AMD SEV-SNP Attacks Put Confidential VM Data at Risk
