Executive brief
A security vulnerability exists in the hardware component of AMD processors that manages how devices interact with system memory. A highly privileged attacker, such as a malicious administrator, could exploit this to bypass certain security protections within the AMD Secure Processor. This could lead to a loss of system integrity, potentially allowing unauthorized modifications to sensitive hardware-level operations.
Technical details
The vulnerability is classified as CWE-1262 (Improper Access Control for Register Interface) within the AMD Input-Output Memory Management Unit (IOMMU). A local attacker with high privileges (PR:H) can exploit improper access controls on the register interface to trigger non-coherent memory accesses by the AMD Secure Processor (ASP). This condition can be leveraged to bypass integrity protections enforced by the ASP. The attack requires specific architectural conditions (AT:P) but does not require user interaction. Mitigation typically involves firmware or BIOS updates from the original equipment manufacturer (OEM).
Affected products
- AMD IOMMU
Timeline
- 2026-06-09: disclosed: Initial disclosure by AMD
- 2026-06-09: advisory: NVD record published