Preface: You can find Ryzen inside:

• Industrial IoT Gateways: Factory machines that handle massive amounts of real-time data.
• Digital Signage & Kiosks: Large public screens and interactive maps in malls or airports.
• Smart Medical Devices: High-end medical imaging and hospital machines.
• Automotive AI: Modern digital car cockpits and self-driving machine systems.

AMD Ryzen Embedded R2000 Series Processors are highly capable, power-efficient System-on-Chips (SoCs) frequently leveraged in autonomous driving, mobile robotics, and ADAS (Advanced Driver Assistance Systems). They function primarily as the central compute brains for vehicle sensor data processing and digital cockpit controls.

Background: Normally, a chip doesn’t need to be desoldered to be updated. An administrator (or an attacker) can use a tool like flashrom inside Linux to talk directly to the motherboard’s built-in SPI controller to read or write to the BIOS chip.

Under normal conditions, hardware security rules called System Management Mode (SMM) ROM protections lock down the SPI controller. Even if you have root access in Linux, the hardware will block flashrom from rewriting critical, protected areas of the BIOS.

CVE-2022-23829 is the exact flaw that breaks this safety net:

• It allows an attacker who already has Ring 0 (kernel-mode / root) access in Linux to bypass that hardware lock.
• Because of this bypass, tools like flashrom or a custom driver can write untrusted or malicious data directly onto the soldered Flash SPI ROM chip.

Once the attacker uses flashrom method to place the malicious data on the chip, the chain reaction on the left side of your image begins:

1.             The Flash SPI ROM Memory Chip now holds the malicious data.

2.             The AMD Secure Processor (ASP) boots up early and automatically reads this data.

3.             Because of a missing size check (insufficient bounds check), the malicious data overflows the processor’s tiny 256-byte buffer, corrupting the memory.

4.             By the time the Main Host x86 Cores wake up to run the standard boot sequence, the system has already been compromised.

Vulnerability details: The Root Cause of CVE-2025-29951 – Official security analysis from AMD Security Bulletin SB-4013 confirms that CVE-2025-29951 lives inside the early AMD Secure Processor (ASP) bootloader.

When the system boots up, the ASP parses external configuration tables and firmware parameters passed from the SPI flash chip. The bootloader copies an input block into a fixed-size local stack variable but fails to perform a boundary length check. An attacker with local access can pass a malicious, oversized table that spills out of the stack variable, allowing them to hijack the execution flow and escalate system privileges.

Official announcement: Please refer to the link for details – https://nvd.nist.gov/vuln/detail/CVE-2025-29951

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4013.html