AMI AptioV UEFI BIOS: Improper input validation in the BIOS with an integrity impact and a changed scope

Impact

Improper input validation in the BIOS with an integrity impact and a changed scope. The score understates why this one matters: AMI states in the advisory that the issue was identified, fixed and disclosed under NDA back in 2018, and that Binarly rediscovered it still unmitigated in multiple systems in the field seven years later. For a fleet operator that is a direct statement about the supply chain - a fix existing at AMI is not the same as a fix reaching your hardware, and the gap can be measured in years. Assume the same is true of every other AptioV CVE in this cluster on any SKU you have not explicitly verified.

Who can reach it

Local access with high privileges and user interaction, at high attack complexity. Requires an attacker who already has administrative control of the host and can induce the right operation - so it is a persistence and privilege-depth bug rather than an entry point.

What to do

BIOS update to AptioV_5.011 or later - firmware flash plus reboot per node. The specific action this CVE demands is different from the others: do not trust version numbers, verify. Pull the actual firmware image off a representative node per SKU and confirm the fix is present, because the whole point of this advisory is that vendors shipped systems that never got the 2018 fix. Prioritise older and white-box SKUs, and any hardware acquired second-hand or through a broker.

References