AMI AptioV BIOS (out-of-bounds memory operation): Local attacker causes firmware memory corruption impacting integrity

Impact

Local attacker causes firmware memory corruption impacting integrity and availability of the platform.

Who can reach it

Local low-privilege access.

What to do

AMI ships the fix to OEMs, not to you - obtain the updated BIOS from your board/server vendor (Supermicro, Gigabyte, ASRock Rack, Quanta, Tyan etc.) and flash it. Expect a lag of weeks to months between the AMI advisory and an OEM image for your exact SKU, and expect some SKUs never to get one. Cold reboot per node.

References

Related entries

• Linux bnxt_en driver (ethtool coredump / bnxt_get_coredump): Out-of-bounds memcpy when retrieving a firmware coredumpCVE-2025-37911 · Linux bnxt_en driver (ethtool coredump / bnxt_get_coredump)High
• Linux kernel Soft-RoCE completion queue (rdma_rxe, rxe_cq_cleanup on create failure): Syzkaller-found slabCVE-2025-38024 · Linux kernel Soft-RoCE completion queue (rdma_rxe, rxe_cq_cleanup on create failure)High
• Linux KVM/SVM - SEV/SEV-ES intra-host migration during vCPU creation: KVM permitted SEV/SEV-ES intra-host migrationCVE-2025-38455 · Linux KVM/SVM - SEV/SEV-ES intra-host migration during vCPU creationHigh
• Dell iDRAC Service Module (iSM): Buffer access with incorrect length in the in-band agent gives a low-privileged localCVE-2025-38743 · Dell iDRAC Service Module (iSM)High
• Linux bnxt_en driver (ring defaults vs traffic classes on ifdown): Memory corruption when firmware resources changeCVE-2025-39810 · Linux bnxt_en driver (ring defaults vs traffic classes on ifdown)High
• Linux kernel (drivers/infiniband/sw/rxe): Use-after-free from a race between a busy soft-RoCE task and its ownCVE-2025-40061 · Linux kernel (drivers/infiniband/sw/rxe)High