Mior and Skyfall attacks let malicious hosts read AMD SEV-SNP VM secrets

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: Confidential VMs on AMD SEV-SNP hardware exposed to malicious hosts

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

The Brief

Two attacks, Mior and Skyfall, were made public this week.
Both let a malicious cloud host read data inside AMD SEV-SNP-protected virtual machines.
Mior can also modify a VM's memory and forge the signed report that attests which software it runs.

Why it matters

AMD SEV-SNP is meant to keep a VM's data private even from the host operator. If these attacks hold, that guarantee does not hold against a malicious host, which matters for anyone relying on confidential computing in the cloud.

The checklist behind the tier

Checklist · 1 of 10 yes

Yes	Hits tech teams	Judgment: AMD SEV-SNP protects cloud VMs that developers and ops teams run and rely on.
No	Core infrastructure	Judgment: a CPU memory-encryption feature in specific AMD chips, not core software nearly every team runs.
No	Popular tool	Judgment: a hardware security feature, not a mainstream framework, tool, platform, OS or package.
No	Exploited in the wild	The Hacker News: attacks were made public as research; no observed real-world attacks reported.
No	Public exploit	The Hacker News: only describes the attacks; no source says exploit code or a PoC is published.
No	Remote, no login	The Hacker News: attacks require a malicious host, i.e. the server operator, not an unauthenticated network attacker.
No	Full takeover	The Hacker News: reading VM data and forging attestation reports; no code execution or admin takeover reported.
No	Secrets exposed	The Hacker News: attacks let a malicious host read VM secrets, but this is a research demonstration, not a reported theft.
No	Supply chain	The Hacker News: no compromise of a developer-trusted package, update, build pipeline or signing key by a legitimate project is reported.
No	No fix yet	The Hacker News: no source states that a patch or fix is available or unavailable.

Timeline

Nov 13
Mior and Skyfall attacks made public
Nov 13 · 3:27 PM
The Hacker News
New Mior and Skyfall Attacks Let Rogue Cloud Hosts Steal Secrets From AMD SEV-SNP VMs

Source

New Mior and Skyfall Attacks Let Rogue Cloud Hosts Steal Secrets From AMD SEV-SNP VMs ↗ The Hacker News · 2h ago

First seen 2h ago · 1 source · Full story page · How tiers are decided