CVE-2025-7028

SMM Arbitrary Memory Access via Flash Handler with Unchecked FuncBlock Pointer

Description

A vulnerability in the Software SMI handler (SwSmiInputValue 0x20) allows a local attacker to supply a crafted pointer (FuncBlock) through RBX and RCX register values. This pointer is passed unchecked into multiple flash management functions (ReadFlash, WriteFlash, EraseFlash, and GetFlashInfo) that dereference both the structure and its nested members, such as BufAddr. This enables arbitrary read/write access to System Management RAM (SMRAM), allowing an attacker to corrupt firmware memory, exfiltrate SMRAM content via flash, or install persistent implants.

N/A

CVSS

Severity:

Affected: GIGABYTE UEFI-SmiFlash

References

Link	Tags
https://www.gigabyte.com/Support/Security
https://www.binarly.io/advisories/brly-dva-2025-010
https://kb.cert.org/vuls/id/746790

Frequently Asked Questions

What is the severity of CVE-2025-7028?: CVE-2025-7028 has not yet been assigned a CVSS score.
How to fix CVE-2025-7028?: To fix CVE-2025-7028, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-7028 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2025-7028 is being actively exploited.
What software or system is affected by CVE-2025-7028?: CVE-2025-7028 affects GIGABYTE UEFI-SmiFlash.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.