Executive brief
A security flaw in AMD's virtualization technology could allow an attacker with low-level access to improperly obtain sensitive encryption keys. This component is responsible for managing secure keys used by virtual machines. If exploited, an attacker could gain unauthorized access to protected data and privileged system resources, compromising the confidentiality of the virtualized environment.
Technical details
A vulnerability classified as improper privilege management (CWE-269) exists in the AMD KVM key download component. The flaw allows an attacker with low privileges to perform a token swap, which facilitates the unauthorized download of sensitive cryptographic keys. The attack vector is network-based but requires high complexity (AC:H) and existing low-level authentication (PR:L). Successful exploitation results in a high impact on confidentiality (VC:H) as the attacker can access keys intended for privileged resources. AMD has addressed this in security bulletin AMD-SB-9023.
Affected products
- AMD KVM Key Download Component
Timeline
- 2026-05-14: disclosed: Initial publication of CVE-2025-62625
- 2026-05-14: advisory: AMD security bulletin AMD-SB-9023 released