Black Hat Europe 2025 | RMPocalypse: A Catch-22 Breaking AMDs Confidential Computing

Why It Matters

The attack compromises the core integrity of AMD’s confidential VM offering, forcing cloud operators to reassess trust in hardware‑based data protection and prompting urgent firmware patches.

Key Takeaways

• AMD SEV‑SNP relies on Reverse Map Table (RMP) for integrity.
• Researchers exploited dirty cache lines to overwrite RMP during boot.
• Attack bypasses PSP protections by racing kernel thread writes.
• Root cause traced to cache‑coherency handling in AMD chiplet design.
• Mitigations require explicit cache flushes and firmware updates.

Summary

The Black Hat Europe 2025 talk, titled “RMPocalypse: A Catch‑22 Breaking AMD’s Confidential Computing,” revealed a novel attack on AMD’s SEV‑SNP technology. The researchers, a PhD student and advisor from ETH Zurich, focused on the Reverse Map Table (RMP), a hardware‑maintained metadata structure that guarantees memory‑access integrity for confidential virtual machines.

By deliberately creating dirty cache lines before the platform security processor (PSP) boots the RMP, the team demonstrated that a racing kernel thread can overwrite RMP entries, effectively breaking the integrity guarantees of SEV‑SNP. Initial experiments showed the attack failed when the RMP was mapped as uncachable, pointing to a cache‑coherency issue. Further analysis of AMD’s open‑source firmware revealed that the PSP writes to the RMP without enforcing cache coherence, leaving a narrow window for exploitation.

The presenters highlighted several technical details: the PSP’s boot sequence, the role of the AMD Infinity Fabric in inter‑core communication, and the mistaken early hypothesis that a “cash concurrency” bug was responsible. After additional testing on Zen cores lacking full coherency for certain addresses, they concluded the vulnerability stemmed from the chiplet architecture’s handling of cache lines during the PSP’s non‑coherent writes.

The discovery has immediate implications for cloud providers and enterprises relying on AMD’s confidential computing to protect data in use. Mitigations include enforcing explicit cache flushes before RMP initialization and updating PSP firmware to ensure coherent writes, underscoring the need for rigorous validation of hardware‑level security mechanisms.

Original Description

AMD SEV-SNP offers confidential computing in form of confidential VMs, such that the untrusted hypervisor cannot tamper with its confidentiality and integrity. SEV-SNP, the latest addition, ensures integrity via the Reverse Map Table (RMP) that stops the hypervisor from tampering guest page mappings. AMD uses RMP entries to protect the rest of the RMP, thus causing a Catch-22 during the RMP setup phase. To address this, SEV-SNP relies on AMD's Platform Security Processor (PSP), that resides next to the x86 cores executing SEV-SNP VMs, to perform the RMP initialization. We present RMPocalypse, a novel attack that shows insufficiency during RMP initialization and exploits it to break not only integrity but also confidentiality guarantees of SEV-SNP. We demonstrate RMPocalypse by enabling debug on production-mode CVMs, faking attestation, VMSA state rollback, and code injection

By: Benedict Markus Schlüter | PhD Student, ETH Zurich