CERT: Major security vulnerability in motherboards
What is it about?
Gigabyte, a manufacturer of computer motherboards, has vulnerabilities in some of its UEFI firmware versions (i.e., the software that runs when the computer starts up). These vulnerabilities affect a particularly sensitive area called SMM (System Management Mode), which is much deeper than the operating system.
What’s the issue?
In this SMM mode, there are program parts (known as “callouts”) that do not check inputs correctly. An attacker with administrator access to the operating system could exploit this to execute their own commands in the extremely protected SMM area – even before the operating system has fully started up.
What are the risks?
- Uncontrolled firmware manipulation – An attacker can modify parts of the firmware.
- Deactivation of security mechanisms – Features such as Secure Boot could be disabled, allowing other malware to remain permanently installed.
- Difficult to detect – Since SMM operates below the operating system, virus scanners and firewalls usually do not detect such attacks.
What specific vulnerabilities were found?
Four vulnerabilities were discovered in Gigabyte UEFI that allow attacks via faulty pointer control (e.g., through registers such as RBX, RCX):
- CVE‑2025‑7029: Uncontrolled pointers for power and thermal configuration
- CVE‑2025‑7028: Incorrect verification of function pointers for accessing flash memory
- CVE‑2025‑7027: Double pointer dereference in NVRAM variables
- CVE‑2025‑7026: further uncontrolled writing to protected memory
What can you do?
- Install the firmware update!
Gigabyte has released updated UEFI versions that close these security gaps. Users should check the Gigabyte support page to see if their device is affected and install the update. - Caution for other manufacturers!
Other manufacturers that use AMI firmware may also be affected. It is advisable to check for updates regularly.
Abstract:
- Who? Gigabyte motherboards with specific UEFI firmware.
- What? Serious security vulnerabilities in the SMM area, which lies deep beneath the operating system.
- Why is it dangerous? It enables persistent malicious code, bypasses security features, and is difficult to detect.
- Solution: Install urgently available firmware updates.
If you use motherboards from Gigabyte (or other manufacturers) and UEFI updates are available, you should install them as soon as possible—this will protect you from sophisticated attacks.
Sources: https://www.heise.de/news/CERT-warnt-vor-UEFI-Sicherheitsluecken-in-Gigabyte-Firmware-10485906.html, https://kb.cert.org/vuls/id/746790
