Database/Firmware, BMC & network fabric
TianoCore EDK2: transient-execution side channel can leak SMRAM contents to a privileged local attacker
Impact
A privileged local attacker can exploit a transient-execution weakness in EDK2-based BIOS to disclose SMRAM contents. SMRAM holds System Management Mode code and data, the most privileged firmware context on the host. Leaking it can help a later firmware-level attack. Most server UEFI firmware is built on EDK2, so the real exposure depends on whether and when each OEM picks up the fix. The record describes confidentiality impact only.
Who can reach it
Local attacker who already has high privileges on the host OS, such as root or the kernel. Attack complexity is high. Unprivileged users and guest tenants are not described as able to trigger it.
What to do
Check the TianoCore advisory GHSA-7v86-66vf-h88j for the upstream fix, then wait for your server OEM to ship a BIOS that includes it. Applying it means flashing firmware on each node with the node out of service. The record does not list which OEM releases carry the fix.
References
Related entries
- Intel TDX MigTD: vmcall_raw transport detects errors but does not act on them, allowing data corruptionCVE-2026-62275 · Intel TDX Migration Trust Domain (MigTD) vmcall_raw transportMedium
- Arista EOS: stale 802.1X ACL entry survives re-auth and is applied to a new supplicantCVE-2026-75944 · Arista EOS AclAgent (802.1X supplicant ACL state)Medium
- Linux kernel InfiniBand uverbs drivers/infiniband/core/uverbs_cmd.c - ib_uverbs_poll_cq: Kernel memory disclosureCVE-2011-1044 · Linux kernel InfiniBand uverbs drivers/infiniband/core/uverbs_cmd.c - ib_uverbs_poll_cqMedium
- Linux kernel SRP target drivers/infiniband/ulp/srpt/ib_srpt.c: An SRP initiator that issues an ABORT_TASK against anCVE-2016-6327 · Linux kernel SRP target drivers/infiniband/ulp/srpt/ib_srpt.cMedium
- AMD Ryzen with AGESA microcode - FMA3 instruction sequence hang: A long series of FMA3 instructions hangs the systemCVE-2017-7262 · AMD Ryzen with AGESA microcode - FMA3 instruction sequence hangMedium
- Intel processors (speculative store bypass): Spectre v4: a load speculatively executes before an older storeCVE-2018-3639 · Intel processors (speculative store bypass)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.