CVE-2025-61972
HighSummary
The lack of lock bit protection for NBIO registers may allow a local admin-privileged attacker to gain arbitrary access to the System Management Network (SMN), potentially leading to arbitrary code execution in the AMD Secure Processor (ASP) and loss of confidentiality and integrity for SEV-SNP guests.
Risk Assessment
The organization may be exposed to unauthorized access to critical systems and potential data leaks, which could lead to serious legal and financial consequences.
Recommendation
It is recommended to implement appropriate security measures, such as software updates and monitoring access to NBIO registers, to minimize the risk of exploitation of this vulnerability.
Other vulnerabilities in AMD Secure Processor (ASP)
See all- CVE-2023-31317High
Improper restriction of operations within the bounds of a memory buffer in the AMD secure processor (ASP) could allow an attacker to read or write to protected memory potentially resulting in arbitrary code execution.
- CVE-2023-31316High
Improperly preserved integrity of hardware configuration state during a power save/restore operation in the AMD Secure Processor (ASP) could allow an attacker with the ability to write outside the trusted memory range (TMR) to change the execution flow of the Video Core Next (VCN) firmware.
- CVE-2023-20572Medium
An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, allowing the input of an arbitrary message, potentially leading to a loss of data integrity.
- CVE-2023-20540Low
An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, allowing arbitrary message input, potentially leading to a loss of data integrity.
Original NVD description (English source)
Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to gain arbitrary System Management Network (SMN) access, potentially resulting in arbitrary code execution in AMD Secure Processor (ASP) and loss of the SEV-SNP guest's confidentiality and integrity.