Mior and Skyfall Attacks Expose AMD SEV-SNP VMs Allowing Rogue Hosts to Steal Secrets and Modify Memory
Two new attacks named Mior and Skyfall were disclosed this week that enable a malicious hypervisor to bypass AMD SEV-SNP protections on virtual machines. Mior, developed by researchers at ETH Zurich, corrupts the Reverse Map Table during VM startup by redirecting PSP writes through a controlled PCIe device, ultimately allowing memory reads, writes, and forged attestation reports. Skyfall, a joint effort by ETH Zurich and Google, leverages Transient Scheduler Attacks to extract register values and disk encryption keys from failed VM launches without requiring BIOS modifications. Both attacks were demonstrated on AMD EPYC processors across Zen 3, Zen 4, and Zen 5 generations, with AMD issuing corresponding CVEs and firmware updates scheduled through December 2026. The flaws highlight persistent challenges in confidential computing even when hardware memory encryption is enabled.
The Hacker NewsNov 13, 2026Translated from English