Rogue Cloud Hosts Have Found a Chink in AMD’s SEV-SNP Armor, Exposing Sensitive Data
In a disturbing revelation, researchers have uncovered two new attacks, dubbed Mior and Skyfall, that allow malicious cloud hosts to extract sensitive data from Virtual Machines (VMs) protected by AMD’s Secure Encrypted Virtualization (SEV-SNP). These exploits demonstrate the ongoing cat-and-mouse game between attackers and defenders in the cloud security landscape.
The SEV-SNP feature is designed to encrypt VM memory, safeguarding against unauthorized access. However, Mior and Skyfall have identified vulnerabilities that allow rogue cloud hosts to bypass this protection. The attacks work by exploiting weaknesses in AMD’s firmware, which enables an attacker to inject malicious code into the VM, effectively rendering the encryption useless.
The affected parties are users of AMD SEV-SNP-enabled cloud services, particularly those utilizing Virtual Machines (VMs) running on vulnerable hardware configurations. While the researchers have not named specific cloud providers or vendors, it is likely that a range of organizations will need to take action to mitigate these risks.
The attacks rely on an attacker gaining control over the underlying cloud infrastructure, which can be achieved through various means such as social engineering, phishing, or exploiting other vulnerabilities. Once inside, they can use the Mior and Skyfall techniques to access sensitive data within the SEV-SNP-protected VMs. This highlights the importance of robust security measures in place at the infrastructure level.
The significance of these attacks lies not only in the potential exposure of sensitive information but also in the demonstrated weakness of current security protocols. As cloud computing continues to grow, so too will the complexity and interconnectedness of systems. Effective defense strategies must account for this reality by implementing multi-layered protection mechanisms that address vulnerabilities at various levels.
For users of AMD SEV-SNP-enabled cloud services, it is essential to reassess their security posture and take proactive steps to minimize exposure. This may involve verifying hardware configurations, applying firmware updates, or adopting additional security measures such as data encryption and access controls.
Source: The Hacker News — 2026-11-13