VU#746790: SMM callout vulnerabilities identified in Gigabyte UEFI firmware modules

Overview

System Management Mode (SMM) callout vulnerabilities have been identified in UEFI modules present in Gigabyte firmware. An attacker could exploit one or more of these vulnerabilities to elevate privileges and execute arbitrary code in the SMM environment of a UEFI-supported processor. While AMI (the original firmware supplier) has indicated that these vulnerabilities were previously addressed, they have resurfaced in Gigabyte firmware and are now being publicly disclosed.

Description

The Unified Extensible Firmware Interface (UEFI) specification defines an interface between an operating system (OS) and platform firmware. UEFI can interact directly with hardware using System Management Mode (SMM), a highly privileged CPU mode designed for handling low-level system operations. SMM operations are executed within a protected memory region called System Management RAM (SMRAM) and are only accessible through System Management Interrupt (SMI) handlers.

SMI handlers act as a gateway to SMM and process data passed via specific communication buffers. Improper validation of these buffers or untrusted pointers from CPU save state registers can lead to serious security risks, including SMRAM corruption and unauthorized SMM execution. An attacker could abuse these SMI handlers to execute arbitrary code within the early boot phases, recovery modes, or before the OS fully loads.

The following vulnerabilities were identified in Gigabyte firmware implementations:

• CVE-2025-7029 : Unchecked use of the RBX register allows attacker control over OcHeader and OcData pointers used in power and thermal configuration logic, resulting in arbitrary SMRAM writes. (BRLY-2025-011)
• CVE-2025-7028 : Lack of validation of function pointer structures derived from RBX and RCX allows attacker control over critical flash operations via FuncBlock, affecting functions like ReadFlash, WriteFlash, EraseFlash, and GetFlashInfo. (BRLY-2025-010)
• CVE-2025-7027 : Double pointer dereference vulnerability involving the location of memory write from an unvalidated NVRAM Variable SetupXtuBufferAddress NVRAM and the content for write from from an attacker-controlled pointer based on the RBX register, can be used write arbitrary content to SMRAM. (BRLY-2025-009)
• CVE-2025-7026 : Attacker-controlled RBX register used as an unchecked pointer within the CommandRcx0 function allows writes to attacker-specified memory in SMRAM. (BRLY-2025-008)

According to AMI, these vulnerabilities were previously addressed via private disclosures, yet the vulnerable implementations remain in some OEM firmware builds such as in the case of Gigabyte. Gigabyte has issued updated firmware to address the vulnerabilities. Users are strongly advised to visit the Gigabyte support site to determine if their systems are affected and to apply the necessary updates.

Impact

An attacker with local or remote administrative privileges may exploit these vulnerabilities to execute arbitrary code in System Management Mode (Ring -2), bypassing OS-level protections. These vulnerabilities can be triggered via SMI handlers from within the operating system, or in certain cases, during early boot phases, sleep states, or recovery modes—before the OS fully loads.

Exploitation can disable UEFI security mechanisms such as Secure Boot and Intel BootGuard, enabling stealthy firmware implants and persistent control over the system. Because SMM operates below the OS, such attacks are also difficult to detect or mitigate using traditional endpoint protection tools.

Solution

Install the latest UEFI firmware updates provided by your PC vendor. Refer to the Vendor Information section below and Gigabyte’s security website for specific advisories and update instructions. Because these vulnerabilities may affect firmware supplied through the supply chain, other PC OEM vendors may also be impacted. Monitor the Vendor Information section for updates as they become available.

Acknowledgements

We thank the Binarly REsearch team for responsibly disclosing these vulnerabilities to CERT/CC. We also acknowledge Gigabyte’s PSIRT for their collaboration and timely response. This document was written by Vijay Sarvepalli.