Multiple SMM memory corruption vulnerabilities in SMM module

GIGA-BYTE Technology Co., Ltd. has been informed by Binarly REsearch of multiple memory corruption vulnerabilities within the System Management Mode (SMM) modules used in several legacy GIGABYTE/AORUS consumer motherboards. These vulnerabilities exist only on older Intel platforms where the affected SMM modules are implemented; newer platforms are not impacted. Successful exploitation of these vulnerabilities may allow an attacker with local access to elevate privileges or execute arbitrary code within the highly privileged SMM environment.

We acknowledge Binarly’s responsible disclosure, which enabled us to promptly evaluate the issue and initiate work on mitigations for affected legacy products. We appreciate their contribution to the security of the broader PC ecosystem.

GIGABYTE is actively addressing these issues and is releasing BIOS updates according to the following schedule. Affected platforms include (but are not limited to):

Customers using the listed products are strongly encouraged to update to the latest BIOS versions as soon as they become available.