SKYFALL
Microarchitectural Data Sampling on AMD
A transient execution attack that reaches across confidential virtual machines, microcode, and system management memory.
IEEE S&P 2027
Summary
SKYFALL is a microarchitectural data sampling attack on AMD processors. It allows privileged software to recover sensitive data from inside the CPU, crossing isolation boundaries that are supposed to protect confidential virtual machines, microcode, and System Management Mode memory.
The attack builds on Transient Scheduler Attacks (TSA). We show that AMD’s cache way predictor computes an address hash for fast lookup not only for virtual addresses, but also for physical and CPU-internal addresses. An attacker can exploit colliding address hashes between virtual and physical address to sample data that is architecturally inaccessible.
We combine this finding with gaps in existing TSA mitigations to demonstrate three attacks: extracting SEV-SNP guest state, recovering decrypted microcode patches, and leaking protected SMM state. AMD assigned CVE-2026-40671 in response to our findings.
What went wrong?
What is a µtag?
A CPU cache keeps recently used data in the L1 data cache. In the L1 data cache, a memory loads set is pre determined by its address, but its way varies. To avoid checking every way on every access, the CPU predicts which way to read.
This prediction uses a micro-tag (µtag): a small hash derived from an address. AMD initally purposed the µtag to accelerate cache lookup while waiting for the TLB to return the physical address. A matching µtag is a hint to the CPU that the desired data is in a particular way; the full physical tag still has to be checked. Different addresses can produce the same µtag.
Software almost exclusively accesses memory through virtual addresses, which the CPU translates into physical addresses. Way prediction can begin before this translation finishes. Prior to SKYFALL, TSA attacks exploited µtags derived from virtual addresses. Our analysis shows that privileged instructions and CPU-internal memory also have a µtag derived from the physical addresses.
Physical and virtual µtags can alias
A sensitive access through a physical address can leave data in the L1 cache. An attacker then chooses a virtual address with a colliding µtag. Although that address maps to different memory, it can select the way containing the sensitive value.
Prior to SKYFALL AMD only considered the virtual ↔ virtual collision.SKYFALL: physical ↔ virtual.
0x00000000012340000x2c0x00007f00092350000x2cDifferent addresses. Same µtag.Both can select the way containing the protected data.
How are these µtags computed?
For Zen 3 and Zen 4, each output bit is the XOR of two address bits. Bit 0 is the least significant bit. The eight output bits form U = ∑ ui · 2i.
| Output bit | Physical address | Virtual address |
|---|---|---|
| u0 = v12 ⊕ v27 | 0 ⊕ 0 = 0 | 1 ⊕ 1 = 0 |
| u1 = v13 ⊕ v26 | 0 ⊕ 0 = 0 | 0 ⊕ 0 = 0 |
| u2 = v14 ⊕ v25 | 1 ⊕ 0 = 1 | 1 ⊕ 0 = 1 |
| u3 = v19 ⊕ v24 | 0 ⊕ 1 = 1 | 0 ⊕ 1 = 1 |
| u4 = v18 ⊕ v23 | 0 ⊕ 0 = 0 | 0 ⊕ 0 = 0 |
| u5 = v17 ⊕ v22 | 1 ⊕ 0 = 1 | 1 ⊕ 0 = 1 |
| u6 = v16 ⊕ v21 | 1 ⊕ 1 = 0 | 1 ⊕ 1 = 0 |
| u7 = v15 ⊕ v20 | 0 ⊕ 0 = 0 | 0 ⊕ 0 = 0 |
Physical U = 0b00101100 = 0x2c; virtual U = 0b00101100 = 0x2c.
The colliding virtual address flips input bits 12 and 27 together, leaving u0 unchanged. The non-colliding comparison flips only bit 12 back, which changes u0.
TSA-L1 can transiently forward data from a predicted way before the CPU resolves the mismatch. The attacker amplifies a bit of the forwarded value into scheduler contention and measures it with Performance Monitoring Counters (PMCs). Repeated measurements recover the data without architectural access.
Some sensitive paths return without cleanup
AMD’s VERW-based TSA mitigation clears the relevant predictor state. However, some privileged execution paths load sensitive data into the L1 data cache and return without performing VERW-based mitigations. Those paths include an aborting VMRUN, the microcode patch loader, and the SMM exit path examined in our experiments.
For example, VMRUN loads and decrypts confidential guest state before completing all checks. If a later check fails, the instruction aborts. The guest is never entered, but its plaintext state is already in the cache and remains reachable through TSA-L1.
We use AMD’s Instruction Based Sampling (IBS) to trace these internal instruction paths and understand where the protections are missing. The root cause is the combination of physical/virtual µtag aliasing and incomplete predictor-state cleanup.
What did we exploit?
SEV-SNP confidential virtual machines
AMD SEV-SNP is designed to protect a virtual machine from a malicious host, including by encrypting its memory and saved register state. We show that a malicious hypervisor can use an aborting VMRUN to bring decrypted guest state into the L1 cache and then extract it with TSA-L1.
We recover register state from the Virtual Machine Save Area (VMSA) and demonstrate AES-XTS disk-encryption key recovery. The key demonstration uses a modified guest kernel to trigger a VM exit when the key is in registers. We also recover guest memory at three fixed cache-line offsets within a selected page: 0x0c0, 0x380, and 0x3c0. This memory primitive does not expose every byte in a page.
Decrypted microcode patches
The microcode patch loader decrypts updates in a CPU-internal, HyperTransport-addressed region. We sample the residual state and recover decrypted microcode patch contents on all three tested systems.
On the tested EPYC 7313 (Zen 3), we additionally recover the CMAC key used before the EntrySign mitigations. The tested EPYC 9124 and 9334 systems (Zen 4) run with a microcode version that already mitigates EntrySign and do not expose that key through the same procedure. However, they still leak decrypted patch contents.
System Management Mode memory
System Management Mode (SMM) runs privileged firmware in memory that is normally inaccessible even to the operating-system kernel. After returning from SMM, we use TSA-L1 to recover fields from its protected State Save Area, including SMBASE, CR3, and R13.
All tested field values are recovered with 100% accuracy in the experiments. This demonstrates leakage from protected SMM memory.
Frequently asked questions
What privileges does an attacker need?
The confidential-VM attack requires a malicious host or hypervisor. The microcode and SMM demonstrations also use privileged local software.
Does the attack require physical access?
No physical manipulation is needed for our demonstrations. The attacks run in software with the privileges described above.
Does SKYFALL break memory encryption?
It does not break the underlying encryption algorithm. Instead, it samples plaintext after the CPU has decrypted it internally. Encrypting memory does not prevent leakage through residual microarchitectural state.
How reliable and fast is the attack?
In the respective threat model the attack is highly feasible and accurate.
Why do the existing TSA mitigations miss it?
VERW-based predictor clearing works when it executes, but sensitive physical-address and CPU-internal paths were missed by AMD's initial mitigation rollout. A failing VMRUN for an SEV-SNP VM returns without the cleanup normally applied at confidential guest exit.
Is there a patch or CVE?
AMD assigned CVE-2026-40671 and released microcode updates. EDK II assigned CVE-2026-18448.
Paper & citation
IEEE Symposium on Security and Privacy (S&P), 2027. Cite this paper
@inproceedings{schlueter2027skyfall,
title = {{SKYFALL}: Microarchitectural Data Sampling on {AMD}},
author = {Schl{\"u}ter, Benedict and Vezz{\`u}, Alessandro and Moghimi, Daniel and Shinde, Shweta},
booktitle = {2027 IEEE Symposium on Security and Privacy (SP)},
year = {2027},
publisher = {IEEE}
}