HomeCyber SecurityGigabyte motherboards susceptible to UEFI malware bypassing Safe Boot

Gigabyte motherboards susceptible to UEFI malware bypassing Safe Boot


Gigabyte motherboards susceptible to UEFI malware bypassing Safe Boot

Dozens of Gigabyte motherboard fashions run on UEFI firmware susceptible to safety points that permit planting bootkit malware that’s invisible to the working system and might survive reinstalls.

The vulnerabilities might permit attackers with native or distant admin permissions to execute arbitrary code in System Administration Mode (SMM), an surroundings remoted from the working system (OS) and with extra privileges on the machine.

Mechanisms working code beneath the OS have low-level {hardware} entry and provoke at boot time. Due to this, malware in these environments can bypass conventional safety defenses on the system.

UEFI, or Unified Extensible Firmware Interface, firmware is safer because of the Safe Boot characteristic that ensures via cryptographic verifications {that a} machine makes use of at boot time code that’s secure and trusted.

Because of this, UEFI-level malware like bootkits (BlackLotus, CosmicStrand, MosaicAggressor, MoonBounce, LoJax) can deploy malicious code at each boot.

Loads of motherboards impacted

The 4 vulnerabilities are in Gigabyte firmware implementations and have been found by researchers at firmware safety firm Binarly, who shared their findings with Carnegie Mellon College’s CERT Coordination Middle (CERT/CC).

The unique firmware provider is American Megatrends Inc. (AMI), which addressed the problems after a non-public disclosure however some OEM firmware builds (e.g. Gigabyte’s) didn’t implement the fixes on the time.

In Gigabyte firmware implementations, Binarly discovered the next vulnerabilities, all with a high-severity rating of 8.2:

  • CVE-2025-7029: bug in an SMI handler (OverClockSmiHandler) that may result in SMM privilege escalation
  • CVE-2025-7028: bug in an SMI handler (SmiFlash) offers learn/write entry to the System Administration RAM (SMRAM), which may result in malware set up
  • CVE-2025-7027: can result in SMM privilege escalation and modifying the firmware by writing arbitrary content material to SMRAM
  • CVE-2025-7026: permits arbitrary writes to SMRAM and might result in privilege escalation to SMM and protracted firmware compromise

By our depend, there are a little bit greater than 240 motherboard fashions impacted – together with revisions, variants, and region-specific editions, with firmware up to date between late 2023 and mid-August 2024.

BleepingComputer reached out to Binarly for an official depend and an organization consultant instructed us that “over 100 product strains are affected.”

Merchandise from different enterprise machine distributors are additionally impacted by the 4 vulnerabilities however their names stay undisclosed till fixes grow to be obtainable.

Binarly researchers notified Carnegie Mellon CERT/CC concerning the points on April 15 and Gigabyte confirmed the vulnerabilities on June 12, adopted by the discharge of firmware updates, in response to CERT/CC.

Nevertheless, the OEM has not printed a safety bulletin concerning the safety issues that Binarly reported. BleepingComputer has emailed the {hardware} vendor a request for remark however we’re nonetheless ready for his or her response.

In the meantime, Binarly founder and CEO Alex Matrosov instructed BleepingComputer that Gigabyte most certainly hasn’t launched fixes. With lots of the merchandise already having reached end-of-life, customers shouldn’t count on to obtain any safety updates.

“As a result of all these 4 vulnerabilities originated from AMI reference code, AMI disclosed these vulnerabilities some time in the past with their silent disclosure to paid prospects solely underneath NDA, and it triggered vital results for years on the downstream distributors once they stayed susceptible and unpatched” – Alex Matrosov

“Evidently Gigabyte has not launched any fixes but, and lots of the affected units have reached end-of-life standing, that means they are going to doubtless stay susceptible indefinitely.”

Whereas the chance for basic customers is admittedly low, these in crucial environments can assess the particular threat with Binarly’s Danger Hunt scanner instrument, which incorporates free detection for the 4 vulnerabilities.

Computer systems from varied OEMs utilizing Gigabyte motherboards could also be susceptible, so customers are suggested to watch for firmware updates and apply them promptly.

UPDATE [July 14th, 13:23 EST]: Article up to date with remark from Binarly saying that the 4 vulnerabilities have an effect on greater than 100 motherboards, and that merchandise from different distributors are impacted.

Whereas cloud assaults could also be rising extra refined, attackers nonetheless succeed with surprisingly easy methods.

Drawing from Wiz’s detections throughout hundreds of organizations, this report reveals 8 key methods utilized by cloud-fluent menace actors.

RELATED ARTICLES

LEAVE A REPLY

Please enter your comment!
Please enter your name here

- Advertisment -
Google search engine

Most Popular

Recent Comments