CVE-2025-61971 describes a hardware/firmware-level weakness where “lock bit” protection for NBIO (Northbridge I/O) MMIO register access is missing. In plain terms, an attacker with local administrator privileges may be able to change MMIO routing configuration, which can undermine the integrity guarantees of SEV-SNP (AMD Secure Encrypted Virtualization with Secure Nested Paging). The affected software/versions are not specified in the provided material, and no reference content was available to confirm exact product names or version ranges.
Technically, the issue is attributed to missing lock-bit enforcement for NBIO registers. Lock bits are typically used to prevent privileged software from modifying certain MMIO routing or configuration registers after they are set/locked. Without proper lock-bit protection, a local admin-privileged attacker could alter MMIO routing configuration (i.e., how memory-mapped I/O is mapped/forwarded), potentially causing a loss of SEV-SNP guest integrity. The provided information does not include specific code paths, register names, functions, or an exploitation sequence beyond the high-level mechanism (local admin modifies MMIO routing due to missing lock-bit protection).
Impact: a local attacker who already has administrator privileges may be able to modify MMIO routing configuration in a way that results in loss of SEV-SNP guest integrity. This is a serious security outcome because SEV-SNP is designed to protect guest memory integrity/confidentiality boundaries; weakening those guarantees can enable broader compromise scenarios depending on the platform and threat model. The provided CVSS score and severity are not available (“unknown” / N/A), so the exact risk level cannot be quantified from the supplied data. The blast radius is primarily limited to environments where SEV-SNP is in use and where the attacker can obtain local admin privileges.
Mitigation: the provided material does not include patched versions, vendor advisories, or specific configuration workarounds. In general terms consistent with the described root cause, mitigation would require ensuring NBIO registers are protected by proper lock-bit enforcement (i.e., vendor/firmware updates that restore lock-bit protection for the relevant MMIO routing registers). If updates are not available, the practical risk reduction is to limit local administrator access on affected systems and to harden the environment to prevent privilege escalation to local admin. Detection guidance is not available from the provided content; no indicators, logs, or monitoring hooks were included.
poc_available: false
CWE-1233