Skip to content

CCHOST-01: SEV-SNP or TDX host support is enabled

Property Value
Severity high
Platform Hardware fleets (collector)
Lifecycle stage hardware
Evaluated from Evidence sent to the service (collector bundles or registry scans), not from a cloud API scan.

How to fix

  • Enable SMEE, SNP and the RMP in the BIOS (and set the minimum SEV ASID), then reboot. On a hosted bare-metal server where the BIOS is not yours, ask the provider: no kernel or KVM setting can change this.
  • Enable SEV-SNP (SMEE, SNP and RMP in the BIOS; kvm_amd sev_snp=1) or TDX (TME-MK and TDX in the BIOS; kvm_intel tdx=1), then reboot.

After the fix, scan again: the check should report PASS.

  • Runtime detection DET-H17 (Hardware fleets): Collector host check regressed

Generated from untrust 1.3.0 (commit 7ef462d9a0c3).