Intel UEFI reference platforms: active debug code left in firmware allows privilege escalation and DoS

CVSS 8.3CVE-2025-30185Firmware, BMC & network fabriccurated

Impact

Debug code shipped enabled in some Intel UEFI reference platform firmware is reachable from a privileged local context and can be used to alter data, escalate privilege and hang the system. Intel rates integrity and availability high with no confidentiality loss, and marks subsequent-system integrity and availability high too - that is the firmware-escapes-the-OS shape, where a compromise survives a reimage of the host. For a GPU operator the cost is in the remediation, not the reachability: the attacker already needs privileged local access (PR:H), but the fix is a BIOS update on every affected board, and a tampered platform cannot be trusted by attestation afterwards, which matters if you sell confidential-computing or attested-node tiers. Server OEM firmware derived from these reference platforms is the realistic exposure; the record names only Intel's reference code, so confirm with your board vendor rather than assuming.

Who can reach it

Local access with an already-privileged account (Intel scores PR:H, AV:L) - a host root compromise, or an administrator-level process on the platform. No user interaction, no special internal knowledge per Intel. Not reachable from a tenant GPU pod on its own.

What to do

Intel's fix lands as updated reference firmware (INTEL-SA-01378); operators get it through their server OEM's BIOS release, so the real step is to ask Dell, HPE, Supermicro or your ODM which BIOS build carries it for the affected boards. Applying it means a BIOS flash with the node out of service - drain the GPU workloads, flash, reboot, and re-attest if you publish attestation. The advisory names no OEM versions, so do not plan the window until your vendor publishes one.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-30185 https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01378.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.