CVE-2025-61972 describes a hardware/firmware-level security weakness in AMD Secure Processor (ASP) related to System Management Network (SMN) register access. In plain terms, the vulnerability is that “lock bit” protection for NBIO (Northbridge I/O) registers is missing, which could let a local attacker with admin privileges access SMN functionality. The NVD description indicates this may enable arbitrary code execution in the ASP and could also compromise SEV-SNP guest confidentiality and integrity. The affected software/product versions are not provided in the supplied data.
Technically, the issue is described as “missing lock bit protection for NBIO registers.” The attack vector is not specified in the provided material, but the NVD summary states the attacker must be “local admin-privileged.” The exploitation mechanism, as described at a high level, is that the attacker can use the lack of lock-bit enforcement to gain arbitrary SMN access. With arbitrary SMN access, the attacker may be able to influence ASP behavior, leading to arbitrary code execution within the ASP. The NVD also ties this to potential loss of SEV-SNP guest confidentiality and integrity, implying that the attacker’s control over ASP/SMN could undermine the isolation guarantees expected from SEV-SNP.
Impact: If exploited, an attacker could achieve arbitrary code execution in AMD Secure Processor (ASP). Additionally, the NVD description explicitly states “loss of the SEV-SNP guest's confidentiality and integrity,” indicating a breach of protected guest memory/compute integrity and confidentiality. The blast radius is potentially severe because ASP is a foundational security component for AMD platform security features, and compromise could affect SEV-SNP guests. The provided severity is “unknown,” and CVSS metrics are not available (CVSS: N/A; Vector: N/A), so the exact risk rating cannot be derived from the supplied information.
Mitigation: The provided input does not include patched versions, vendor guidance, configuration workarounds, or detection steps. Based strictly on the available text, the only actionable mitigation guidance is not possible to specify (no version numbers or patch references were provided). For operational risk reduction, you would typically look for AMD advisories or platform/firmware updates addressing NBIO register lock-bit protection and SMN/ASP security; however, those details are not present in the supplied content. Therefore, mitigation steps cannot be stated concretely from the provided data.
poc_available: false (No reference content was fetched, and no PoC/exploit technique details were provided.)
CWE-1233