coreboot 4.13-4.16 (SMM handling on application processors): Arbitrary code execution in System Management Mode

Impact

Arbitrary code execution in System Management Mode on application processors - every core other than the bootstrap processor. Scored critical. On a many-core GPU host that is a large number of entry points into ring -2, and SMM compromise means firmware persistence beneath the OS and the hypervisor, forged or suppressed boot measurements, and an implant that a reimage between tenants does not touch. Relevant to operators running open firmware stacks (OCP-style, Open System Firmware, or coreboot-based management and storage nodes) rather than vendor BIOS.

Who can reach it

Local attacker on the host able to reach SMM on a non-bootstrap core. Requires code execution on the node, not remote access.

What to do

Rebuild and reflash coreboot at 4.17 or later - which for coreboot-based fleets is your own build pipeline rather than an OEM download, so the rebase lag is yours to control and can be much shorter than the IBV-to-OEM path. Firmware flash, one reboot per node. No config workaround. Note that coreboot does not publish a CVE-indexed advisory page and has no GitHub security advisories, so tracking its security fixes means watching commits and release notes directly rather than waiting for an advisory feed.

References