Two attacks made public this week allow a malicious host to read data inside AMD SEV-SNP-protected virtual machines (VMs), which are built to keep the server’s operator out.

One of them, Mior, can also modify a VM’s memory and fake the signed report confirming which software it runs. Both need control of the server’s hypervisor, and Mior also needs control of the server’s BIOS. Researchers