Gigabyte UEFI firmware (SMM, NVRAM double pointer dereference): An unvalidated NVRAM variable is dereferenced twice

Impact

An unvalidated NVRAM variable is dereferenced twice inside SMM, letting a local attacker write to SMRAM and gain ring -2 execution. NVRAM variables are writable from the OS on many platforms, which makes this a comparatively short path from host root to firmware-level persistence.

Who can reach it

Local privileged code on the host, able to set the UEFI variable. Any tenant with root on a bare-metal node qualifies.

What to do

Gigabyte BIOS update per board model plus reboot. No config workaround - locking down NVRAM variable writes is not generally available to operators. Bundle with the other three SMM CVEs in the same advisory; they ship in the same image.

References

Related entries

• Gigabyte UEFI firmware (SMM, unvalidated flash function pointers): Function pointer structures governing SPI flashCVE-2025-7028 · Gigabyte UEFI firmware (SMM, unvalidated flash function pointers)Unscored
• Gigabyte UEFI firmware (SMM, OcHeader/OcData pointer control): Unchecked register use lets the attacker controlCVE-2025-7029 · Gigabyte UEFI firmware (SMM, OcHeader/OcData pointer control)Unscored
• U-Boot: integer overflow in ZFS metadata parsing gives out-of-bounds access during bootCVE-2025-70290 · Das U-Boot (ZFS filesystem support, on-disk metadata parsing)Unscored
• libtpms (OpenSSL 3.x symmetric cipher IV handling): libtpms 0.10.0/0.10.1 built against OpenSSL 3.x returnedCVE-2026-21444 · libtpms (OpenSSL 3.x symmetric cipher IV handling)Unscored
• Arm Trusted Firmware-A BL1/BL2 boot stages on platforms that load firmware from a Firmware Image Package (FIP)CVE-2026-34878 · Arm Trusted Firmware-A BL1/BL2 boot stages on platforms that load firmware from a Firmware Image Package (FIP) containerUnscored
• Linux kernel IPMI: refcount leak on the supplied-recv error path permanently pins the IPMI userCVE-2026-72040 · Linux kernel IPMI driver (i_ipmi_request supplied-recv error path)Unscored