  AMD Secure Encrypted Virtualization (SEV) offers protection mechanisms for
virtual machines in untrusted environments through memory and register
encryption. To separate security-sensitive operations from software executing
on the main x86 cores, SEV leverages the AMD Secure Processor (AMD-SP). This
paper introduces a new approach to attack SEV-protected virtual machines (VMs)
by targeting the AMD-SP. We present a voltage glitching attack that allows an
attacker to execute custom payloads on the AMD-SPs of all microarchitectures
that support SEV currently on the market (Zen 1, Zen 2, and Zen 3). The
presented methods allow us to deploy a custom SEV firmware on the AMD-SP, which
enables an adversary to decrypt a VM's memory. Furthermore, using our approach,
we can extract endorsement keys of SEV-enabled CPUs, which allows us to fake
attestation reports or to pose as a valid target for VM migration without
requiring physical access to the target host. Moreover, we reverse-engineered
the Versioned Chip Endorsement Key (VCEK) mechanism introduced with SEV Secure
Nested Paging (SEV-SNP). The VCEK binds the endorsement keys to the firmware
version of TCB components relevant for SEV. Building on the ability to extract
the endorsement keys, we show how to derive valid VCEKs for arbitrary firmware
versions. With our findings, we prove that SEV cannot adequately protect
confidential data in cloud environments from insider attackers, such as rogue
administrators, on currently available CPUs.
