Preface: Web hosting companies can use AMD EPYC 9004 Series processors for demanding and high-traffic websites, but they are more suitable for large-scale or specialized workloads due to their high cost and performance focus on areas like AI, HPC, and cloud-native computing.

Background: During Secure Nested Paging (SNP) initialization, the Reverse Map Table (RMP) is set up by software (firmware) to map system physical addresses to guest memory and enforce page ownership and write permissions. The RMP is a system-wide table, indexed by the System Physical Address (SPA), with each entry corresponding to a 4KB chunk of memory, indicating which owner has access to it and how it can be written to. This is crucial for preventing the hypervisor from maliciously accessing a guest’s private, encrypted memory.

Ref: For AMD SEV-SNP systems, the best hypervisor depends on your specific needs, but Proxmox is a strong contender for a feature-rich, open-source option, while VMware vSphere is an excellent choice for enterprise environments already invested in the VMware ecosystem. For users who prefer Linux, adding a confidential computing kernel to a distribution like Ubuntu enables robust SEV-SNP support through open-source tools like libvir

Vulnerability details: Researchers from ETHz reported that a malicious hypervisor could corrupt the Reverse Map Table (RMP) during Secure Nested Paging (SNP) initialization.

AMD reproduced the issue and determined it is due to a race condition that can occur while the AMD Secure Processor (ASP) is initializing the RMP. This attack could allow a malicious hypervisor to manipulate the initial RMP content, potentially resulting in loss of SEV-SNP guest memory integrity. AMD has released mitigations for this vulnerability.

Official announcement: Please see the link for details –

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3020.html