Zhenyu Liu

AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Out-of-Bound Read” by local access. Successful exploitation of this vulnerability may lead to a denial of service during firmware update processing, such as a crash or failed update if the out-of-bounds read hits unmapped memory. It could also potentially impact Confidentiality and Availability.

AMI APTIOV contains vulnerabilities in BIOS where privileged users may cause the “Out-of-Bounds Read” by local access. Successful exploitation of this vulnerability may lead to a denial of service during firmware update processing, such as a crash or failed update if the out-of-bounds read hits unmapped memory. It could also impact Confidentiality, and Availability.

AMI APTIOV contains vulnerabilities in BIOS where privileged users may cause the “Out-of-Bounds Write” by local access. Successful exploitation of this vulnerability may lead to a denial of service during firmware update processing, such as a crash or failed update if the out-of-bounds write hits unmapped memory. It could also impact Integrity, and Availability.

An unvalidated memory boundary in the code developed for HP projects allows for arbitrary code execution. Specifically, an out-of-bounds write exists in the `H19WMIHandlerSmm` module (GUID f1946499-571b-44c3-9b9c-cc55210b0c02). An attacker with local kernel privileges can trigger a Software SMI (System Management Interrupt), which is a high-priority interrupt that suspends all other system activities to execute code in System Management Mode (SMM). This allows for a privilege escalation from ring 0 (kernel) to ring -2 (SMM), enabling arbitrary physical memory writes, including SMRAM. This can lead to the implantation of a persistent SMM rootkit that bypasses Secure Boot and survives operating system reinstallation.