Description
Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known vulnerabilities to decrypt memory potentially resulting in loss of confidentiality.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| AMD | AMD EPYC™ 9004 Series Processors | affected |
|
||||||
| AMD | AMD EPYC™ 7003 Series Processors | affected |
|
||||||
| AMD | AMD EPYC™ 8004 Series Processors | affected |
|
||||||
| AMD | AMD EPYC™ Embedded 7003 Series Processors | affected |
|
||||||
| AMD | AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa") | affected |
|
||||||
| AMD | AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Bergamo") | affected |
|
||||||
| AMD | AMD EPYC™ Embedded 8004 Series Processors | affected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
History
Tue, 10 Nov 2026 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known vulnerabilities to decrypt memory potentially resulting in loss of confidentiality. | |
| Weaknesses | CWE-321 | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: AMD
Published:
Updated: 2026-11-10T22:12:39.351Z
Reserved: 2025-10-09T19:57:20.770Z
Link: CVE-2026-0003
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
-
CWE-321
Use of Hard-coded Cryptographic Key