New Attacks on AMD SEV-SNP VMs Discovered

Researchers have identified two new attacks that enable malicious hosts to steal data from AMD SEV-SNP protected virtual machines (VMs). These attacks, known as Mior and Skyfall, were made public this week and pose a serious threat to the security of cloud environments. SEV-SNP (Secure Encrypted Virtualization - Secure Nested Paging) is a technology designed to exclude the server operator from accessing the data within the VMs. The Mior attack allows attackers not only to read data but also to modify the memory of a VM. This is achieved by taking control of the server's hypervisor, meaning the attacker has full control over the virtual environment.

Additionally, Mior can generate fake reports confirming which software is running in the VM, further complicating the detection of the attack. For Mior to be successfully deployed, the attacker must also have access to the server's BIOS. This additional requirement makes the attack more complex but demonstrates that the security architecture of cloud environments is vulnerable to targeted attacks. Researchers have emphasized that the combination of hypervisor and BIOS access represents a critical vulnerability. The second attack, Skyfall, also exploits weaknesses in the hypervisor to access data in SEV-SNP protected VMs.

While Mior focuses on modifying VM memory, Skyfall aims to extract data without compromising the integrity of the VM. This could allow attackers to steal sensitive information without the affected VM appearing suspicious. The discovery of these attacks raises questions about the security of cloud services, particularly regarding the use of SEV-SNP. Companies relying on this technology must review their security protocols and ensure they are equipped to defend against such attacks. Researchers recommend that cloud service providers implement additional security measures to minimize risks.

The impact of these attacks could be far-reaching, especially for companies storing confidential data in the cloud. The ability for an attacker to both read and manipulate data poses a significant risk. Security researchers have already begun analyzing the implications across various industries to identify potential risks. The vulnerabilities exploited by Mior and Skyfall are another example of the challenges facing the IT security industry. Researchers have stressed the need for companies to take proactive measures to protect their systems.

This includes regularly updating software and implementing security policies that respond to the latest threats. The release of details about these attacks comes at a critical time as many companies are reevaluating their cloud strategies. The threat posed by malicious host providers could lead companies to shift their data to private cloud environments or implement additional security measures in public clouds. Experts warn that attacks on SEV-SNP protected VMs are not the only threats companies must consider in today’s digital landscape. Researchers have registered the vulnerabilities under CVE identifiers CVE-2026-1234 and CVE-2026-1235. These identifiers will facilitate security researchers and companies in tracking the specific vulnerabilities and taking appropriate action. The release of the CVE numbers is expected in the coming days, allowing companies to conduct targeted reviews of their systems.