Two new attacks, Mior and Skyfall, let a malicious cloud host read data inside AMD SEV-SNP VMs. Mior can even fake the signed report. Here's what it means for you.
AMD's SEV-SNP has long been sold as a kind of vault for virtual machines. The whole promise is simple: even the cloud provider running the hardware shouldn't be able to peek inside your VM. This week, that promise got a lot shakier.
Two attacks went public, and both let a malicious host read data sitting inside SEV-SNP-protected VMs. If you rent cloud capacity and assume your provider can't see your secrets, this is the story to pay attention to.
### What Mior and Skyfall Actually Do
Let's keep it plain. SEV-SNP encrypts VM memory and hands out a signed report confirming what software is running. That report is the thing customers trust when they verify a VM hasn't been tampered with.
Mior goes further than reading. It can also modify a VM's memory and fake that signed report, making it look like the expected software is running when it isn't. Skyfall, the second attack, sticks to reading data. Both are serious, but Mior is the one that should keep you up at night.
### The Catch: You Need Deep Access
Here's the part that keeps this from being a five-alarm fire for everyone. Neither attack is something a random attacker pulls off from a laptop.
- Both require control of the server's hypervisor
- Mior also needs control of the server's BIOS
- That means a rogue or compromised cloud host, not a casual outsider
So the threat model is a provider that's hostile, breached, or simply sloppy. That's a narrower group than "anyone on the internet," but it's exactly the group SEV-SNP was built to defend against.
### Why This Matters If You Trust the Cloud
The uncomfortable truth is that confidential computing rests on a single assumption: the hardware keeps its word. When researchers show that assumption can bend, the marketing around "operator-proof" VMs starts to feel optimistic.
> "The whole point of confidential computing is that you don't have to trust the host. These attacks chip away at that exact guarantee."
That doesn't mean you should abandon SEV-SNP tomorrow. It does mean you should stop treating it as an absolute. Defense in depth still wins. Encrypt sensitive data at the application layer, rotate credentials, and don't hand a VM more trust than it needs.
### What to Do Next
Watch for AMD's response and firmware patches, and check whether your provider has published guidance. Ask hard questions about who controls the hypervisor and BIOS on the machines running your workloads.
The bigger lesson is the one security folks keep relearning: any protection that depends on the host behaving itself is only as strong as the host. SEV-SNP is still useful. It's just not magic, and it never was.
