The Fabricked exploit stealthily destroys the hardware protection of EPYC chips with full effectiveness—AMD has already released a fix

Short summary

In April researchers from ETH Zurich discovered a vulnerability in the hardware protection of AMD SEV‑SNP that allows an attacker to gain full access to the protected memory of a virtual machine (CVM) on AMD EPYC processors. The exploit, named Fabricked, exploits weaknesses in memory routing through Infinity Fabric during boot and can trick the cryptographic attestation that users rely on to verify the integrity of their environment.

1. What is AMD SEV‑SNP and why it’s needed
* Confidential computing allows cloud tenants to ensure that the provider cannot read their data.
* SEV‑SNP creates hardware-isolated virtual machines: memory is encrypted, and access is controlled by an embedded security processor – PSP (Platform Security Processor).
* During boot, the PSP initializes a Reverse Map Table (RMP) – an access table for each page of memory.
Attestation (cryptographic verification) depends on correct operation of the RMP.

2. How Fabricked works
1. The problem in UEFI
* AMD devices use UEFI to configure Infinity Fabric – the inter‑chip network that routes memory traffic between cores, controllers, and peripherals.
* During boot, UEFI calls two PSP‑API functions that “lock” Infinity Fabric configuration registers after they are set.
* If UEFI is tampered with (which is possible because it’s controlled by cloud providers), these calls can be skipped, leaving the Data Fabric writable even after SEV‑SNP activation.

2. MMIO check deficiency
* When PSP requests memory access, the check first passes through MMIO rules (for interacting with hardware devices) and then through normal DRAM rules.
* An attacker can configure MMIO mappings to “shadow” the RMP region. As a result, PSP writes are ignored, but SEV‑SNP still reports successful initialization.

3. Result – an uninitialized RMP remains under attacker control. The hypervisor gains the ability to read and write arbitrary memory regions of the CVM without detection by the guest OS.

3. Demonstration of exploits
* Enabling debug mode on a running CVM after attestation – the hypervisor can decrypt any part of memory while remaining undetected.
* Mass replacement of attestation reports – allows an attacker to issue false confirmations of environment integrity.

4. What this means for users
* The vulnerability is fully deterministic and has 100 % success probability without physical access to the server.
* No code execution inside the virtual machine is required – just a cloud host that controls UEFI.
* Users relying on SEV‑SNP for confidential computing risk losing control over their data.

5. What researchers say
The results are published in the paper *USENIX Security 2026*. The authors emphasize that Fabricked bypasses a key attestation mechanism and demonstrate practical exploits confirming the seriousness of the threat.

Conclusion:

Fabricked exposes a fundamental vulnerability in the AMD SEV‑SNP protection chain. If no measures are taken to update UEFI and strengthen RMP verification, cloud providers can gain full access to the protected memory of virtual machines without detection by tenants.