CVE-2025-48514Insufficient Granularity of Access Control in Amd64-microcode

Severity
4.0MEDIUMNVD
EPSS
0.0%
top 95.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 10

Description

Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, potentially resulting in a loss of confidentiality.

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-fjcx-f2hr-qjjr: Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, potentially r2026-02-10
OSV
CVE-2025-48514: Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, potentially r2026-02-10

📋Vendor Advisories

1
Debian
CVE-2025-48514: amd64-microcode - Insufficient Granularity of Access Control in SEV firmware can allow a privilege...2025

🕵️Threat Intelligence

1
Wiz
CVE-2025-48514 Impact, Exploitability, and Mitigation Steps | Wiz