Database/Control plane, storage & DevOps
AmdPlatformRasSspSmm - SMM callout (AMD-SB-7028): An SMM callout in the platform RAS SMM driver lets ring-0 code modify
Impact
An SMM callout in the platform RAS SMM driver lets ring-0 code modify boot service handlers and execute at SMM. Reported by Eclypsium. Worth noting the irony for a GPU operator: the affected driver is the platform's *reliability and error-reporting* code, so the component you depend on to tell you a node is unhealthy is the one handing over the platform.
Who can reach it
Local, ring-0 on the host.
What to do
Fixed in AMD PI/AGESA firmware and delivered only as an OEM SBIOS package - AMD ships the PI drop to Dell, HPE, Supermicro, Lenovo and the ODMs, who each requalify before releasing BIOS. **Budget one to six months of OEM lag**, and note that several CVEs in this batch are marked 'no fix planned' on Naples (EPYC 7001) - for those the only remediation is retiring the hardware. Applying it means cordon, drain and a full power cycle per node; there is no driver reload, no live patch and no VBIOS step.
References
Related entries
- AmdPspP2CmboxV2 - SMM input validation (AMD-SB-7027): Insufficient input validation in the AmdPspP2CmboxV2 SMM driverCVE-2024-21925 · AmdPspP2CmboxV2 - SMM input validation (AMD-SB-7027)High
- OpenTelemetry Collector: Unsafe decompressionCVE-2024-36129 · OpenTelemetry CollectorHigh
- VMware Aria Automation (DOM-based XSS, token theft): A crafted URL steals the access token of a logged-in AriaCVE-2025-22249 · VMware Aria Automation (DOM-based XSS, token theft)High
- OpenShift Hive / MCE / ACM (vCenter credential exposure): vCenter credentials are written into the ClusterProvisionCVE-2025-2241 · OpenShift Hive / MCE / ACM (vCenter credential exposure)High
- Jenkins (Git Parameter plugin): Git parameter value is not validated against the offered choicesCVE-2025-53652 · Jenkins (Git Parameter plugin)High
- Foreman: command injection in the errors:fetch_log rake task escalates a scoped sudo grant to full code executionCVE-2026-12540 · Foreman / Red Hat Satellite (foreman-rake errors:fetch_log task)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.