Gigabyte CVE-2025-702{6-9}

Július 10. hír, de eddig elkerülte a figyelmemet..

An attacker could exploit this vulnerability to elevate privileges from ring 0 to ring -2 and execute arbitrary code in System Management Mode, an environment more privileged than and completely isolated from the operating system (OS). Running arbitrary code in SMM also bypasses SMM-based SPI flash protections against modification, which can help an attacker to install a firmware backdoor/implant. Such malicious code in the firmware could persist through operating system reinstallations. In addition, this vulnerability could potentially be used by malicious actors to bypass security mechanisms provided by UEFI firmware, such as Secure Boot and some types of memory isolation for hypervisors.

https://www.binarly.io/advisories/brly-dva-2025-008

https://www.binarly.io/advisories/brly-2025-009

https://www.binarly.io/advisories/brly-dva-2025-010

https://www.binarly.io/advisories/brly-dva-2025-011

[..]Dozens of Gigabyte motherboard models run on UEFI firmware vulnerable to security issues that allow planting bootkit malware that is invisible to the operating system and can survive reinstalls.[..]

In Gigabyte firmware implementations, Binarly found the following vulnerabilities, all with a high-severity score of 8.2:

• CVE-2025-7029: bug in an SMI handler (OverClockSmiHandler) that can lead to SMM privilege escalation
• CVE-2025-7028: bug in an SMI handler (SmiFlash) gives read/write access to the System Management RAM (SMRAM), which can lead to malware installation
• CVE-2025-7027: can lead to SMM privilege escalation and modifying the firmware by writing arbitrary content to SMRAM
• CVE-2025-7026: allows arbitrary writes to SMRAM and can lead to privilege escalation to SMM and persistent firmware compromise

https://www.bleepingcomputer.com/news/security/gigabyte-motherboards-vu…