Preface: AMD EPYC processors include RAPL (Running Average Power Limit) functionality, which provides a standardized cross-vendor interface for enterprise data centers. Enterprise Linux ecosystems rely heavily on built-in diagnostic and orchestration frameworks. By exposing counters through the RAPL standard via the Linux PowerCap and perf subsystems, server administrators can monitoring AMD hardware.
Background: AMD Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) is designed to protect a guest VM’s data and memory from an untrusted or compromised host hypervisor. However, because RAPL is accessible by the host to track system energy, it can inadvertently expose the inner operations of the protected guest VM.
An attacker with root access to the host hypervisor can read RAPL Model-Specific Registers (MSRs) at high speeds. By analyzing these microjoule-level fluctuations, they can reconstruct what operations or data inputs are occurring inside the secure SEV-SNP virtual container. This mirrors the mechanics of the well-known “Platypus” side-channel attack.
The attack vector in the “Cohere+Reload” technique targets a spatial granularity of 2 kB blocks (coherence partitions) because of how the AMD EPYC hardware architecture manages coherence conflicts between encrypted and unencrypted memory states.
The 2 kB spatial granularity is not a random limitation; it is directly dictated by the structural boundary of AMD’s internal cache-coherence domains for secure memory. When the victim VM executes code or pulls data inside a specific 2 kB partition, it triggers a coherence conflict with the host hypervisor’s tracked lines. The Cohere+Reload attack works by having the attacker “Reload” a page and measure the execution timing. While the initial hardware conflict barrier occurs at the 2 kB block level, attackers can actually refine this spatial resolution down to 256 bytes by measuring the precise microsecond amplitude of the timing delay (which scales with the exact number of cache line evictions performed within that partition). You can say that this 256-byte spatial resolution is precisely what allows an attacker to extract highly sensitive Confidential Virtual Machine (CVM) secrets. The 256-byte resolution directly aids the attacker in finding VM secrets because of how it aligns with common cryptographic vulnerabilities!
AMD-SB 3032 Overview:
The Core Threat: Attackers combine software-based power and cache side-channel techniques (like Cohere+Reload) to extract virtual machine secrets.
The Weakness:The reported technique relies heavily on hypervisor access to the RAPL (Running Average Power Limit) interface.
AMD’s Position:Fully malicious hypervisors fall outside the traditional SEV-ES threat model boundary.
The Mitigation:SEV-SNP mitigates this attack vector completely via a supported configuration option to restrict or disable hypervisor access to RAPL.
Official announcement: Please refer to link for details – https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3032.html