CVE-2025-54501
Awaiting Analysis Awaiting Analysis - Queue

Improper Access Control in AMD SEV-SNP Guest Memory

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: Advanced Micro Devices Inc.

Description
Improper access control on an internal debug interface could allow a high privileged attacker to bypass memory access controls potentially resulting in a loss of SEV-SNP guest memory integrity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2025-54501
EUVD
EUVD-2025-211317

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
amd epyc_7003_series *
amd epyc_9005_series *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1191 The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-54501 is an improper access control flaw in an internal CPU debug interface on AMD processors. It allows a highly privileged attacker to bypass memory access restrictions, potentially enabling unauthorized physical memory writes. This could corrupt memory structures and compromise guest isolation in SEV-SNP environments.

Detection Guidance

Detection requires checking firmware versions and SEV-SNP mitigation status. Use system management tools like dmidecode or AMD's tools to verify firmware versions against AMD's bulletin. Check if the mitigation bit is enabled in the hypervisor or firmware settings. No direct network detection commands are available as this is a local hardware-level issue.

Impact Analysis

The vulnerability requires local access and high privileges to exploit. If exploited, it could allow an attacker to modify protected memory, potentially leading to loss of guest memory integrity in SEV-SNP environments. This could result in unauthorized access or manipulation of sensitive data.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially allowing unauthorized access to sensitive memory, which may contain personal or health data. Loss of memory integrity in SEV-SNP environments could lead to data breaches or unauthorized modifications, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Update to the latest Platform Initialization (PI) firmware versions specified by AMD for your EPYC series. Enable the SEV-SNP mitigation bit in firmware settings. Ensure hypervisor and guest OS are updated to versions supporting the mitigation. Monitor AMD's security bulletin for additional guidance.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-54501. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...