AmpereOne firmware: malformed SMC call to the UEFI-MM BERT driver reads and corrupts Secure Partition memory

CVSS 4.6CVE-2025-62862Firmware, BMC & network fabriccurated

Impact

A Non-Secure process on an AmpereOne host can issue an incorrectly formed SMC call into the UEFI-MM Boot Error Record Table driver and either leak Secure-EL0 memory contents back into the Non-Secure world or write out of bounds, corrupting Secure or Non-Secure memory. The write is bounded to memory the Secure Partition Manager has mapped into the UEFI-MM Secure Partition, so this is a firmware-trust-boundary break rather than a direct host takeover, but it undermines the firmware layer that a GPU node's attestation and error-reporting path sits on. AmpereOne is a datacenter CPU used as the host for accelerator shelves, so the affected machines are compute hosts, not clients. The vendor rates it 4.6 and the CVSS vector marks scope change with high privilege required.

Who can reach it

Local, privileged software on the host (CVSS PR:H) able to make SMC calls into firmware. No network or management-VLAN path, and no tenant-level path unless a tenant already holds high privilege on the host.

What to do

Update platform firmware to the fixed level for your SKU: AmpereOne AC03 3.5.9.3, AmpereOne AC04 4.4.5.2, AmpereOne M 5.4.5.1, per Ampere bulletin AMP-SB-0007. This is a platform firmware flash, so each host has to be drained and taken out of service for the update and reboot; there is no runtime mitigation in the advisory.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-62862 https://amperecomputing.com/products/security-bulletins/amp-sb-0007 https://amperecomputing.com/products/product-security

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.