New Mior and Skyfall Attacks Target AMD SEV-SNP Confidential VMs

What happened

Researchers this week disclosed two new attacks, called Mior and Skyfall. Both let a malicious cloud host operator read data from inside virtual machines protected by AMD SEV-SNP. SEV-SNP is a hardware feature built to keep the server operator out of guest VM contents.

Mior can do more than read. It can also modify a VM's memory and forge the signed attestation report that a VM uses to prove which software it is running. Both attacks require control of the server's hypervisor. Mior also requires control of the server's BIOS.

Why it matters for defenders

Cloud tenants rely on SEV-SNP as a trust boundary because they cannot otherwise verify how a provider runs its infrastructure. These attacks weaken that boundary for anyone who assumed a hypervisor or BIOS compromise at the host was out of scope. Mior's ability to forge attestation reports is notable. A compromised host could pass remote attestation checks while still tampering with or spying on the guest. This matters most for organizations running sensitive workloads such as secrets management, key material, or regulated data in SEV-SNP VMs on infrastructure they do not fully control.

What defenders should watch for now

• Do not treat SEV-SNP attestation as the sole trust anchor for highly sensitive workloads. Add integrity and monitoring controls where feasible.
• Cloud and infrastructure operators should prioritize firmware and BIOS integrity controls such as measured boot and BIOS update verification, given Mior's reliance on BIOS access.
• Review attestation verification workflows to understand what they actually prove. Watch for guidance or patches from AMD and cloud providers on these attacks.
• Hunt for unusual hypervisor-level access or unexpected BIOS or firmware changes on hosts running confidential-computing workloads.
• Track any detail from the researchers on affected AMD SEV-SNP firmware or microcode versions once published, as this will determine patch applicability.

Developing story

This is new research disclosed this week. Full technical details, including affected firmware versions, proof-of-concept status, and vendor response, were still emerging at the time of writing. We will track this story and update detection guidance as more indicators or AMD advisories appear. Read the original report at The Hacker News.