Re: AMD Microcode Signature Verification Vulnerability

[Jacob Bachmeyer <jcb62281 () gmail com>]

On 2/4/25 04:10, Solar Designer wrote:
> On Wed, Jan 22, 2025 at 07:52:48AM -0800, Tavis Ormandy wrote:
> > [...]
> >
> > AMD SEV-SNP users can verify the fix by confirming TCB values for SNP in
> > their attestation reports (can be observed from a VM, consult AMD's
> > security bulletin for further details).
> >
> > [...]
> The corresponding AMD security bulletin is:
>
> https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3019.html
>
> > [...] Additionally, an SEV firmware update
> > is required for some platforms to support SEV-SNP attestation. Updating
> > the system BIOS image and rebooting the platform will enable attestation
> > of the mitigation. A confidential guest can verify the mitigation has
> > been enabled on the target platform through the SEV-SNP attestation
> > report.

[*raises hand*]

If an attacker is able to control the hypervisor (necessary to load 
rogue microcode) and the processor microcode, how can the VM trust that 
it is actually verifying that attestation and not being sent down a "oh 
yes it is exactly what you want it to be" garden path?

Do the instructions necessary to obtain and verify that attestation not 
use microcode at all?


-- Jacob