New Firmware Flaw in AMI Aptio UEFI Threatens Persistent System Compromise

A new security vulnerability disclosed by CERT/CC highlights serious risks in AMI Aptio UEFI firmware, which powers a wide range of PCs across the supply chain. The flaw, tracked as CVE-2025-33043, resides in System Management Mode (SMM)—one of the most privileged execution environments on modern CPUs.

According to the advisory, “System Management Mode (SMM) memory corruption vulnerabilities have been identified in UEFI modules present in AMI Aptio UEFI firmware. An attacker could exploit this vulnerability to elevate privileges and execute arbitrary code in the highly privileged SMM environment.”

System Management Mode (SMM) is a hidden CPU mode used for critical operations such as hardware control and power management. It runs within a protected region of memory called System Management RAM (SMRAM), often referred to as “ring -2” due to its deeper privilege level compared to the OS kernel (ring 0) and hypervisors (ring -1).

CERT/CC explains the root cause: “A vulnerability has been identified in certain firmware modules of AMI APTIOV related to improper pointer validation. Specifically, the code fails to adequately validate pointer values to prevent overlap with SMRAM. This allows memory references to be redirected into SMRAM, potentially enabling unauthorized code execution within SMM.”

If successfully exploited, attackers could corrupt memory, overwrite sensitive firmware data, and even write malicious components into PCI flash memory. This type of persistent compromise is especially dangerous because it can survive operating system reinstalls and evade traditional endpoint protections.

The advisory warns that “successful exploitation of this vulnerability may allow execution of code within System Management Mode (SMM), a highly privileged environment in firmware. This could bypass certain firmware-level protections, such as those protecting the SPI flash memory, and enable persistent modifications to the firmware that operate independently of the OS.”

In short, once attackers gain this level of access, they could maintain covert control over a system indefinitely.

CERT/CC advises all affected users to apply vendor-issued patches as soon as possible. “Install the latest UEFI firmware updates provided by your PC vendor… As these vulnerabilities may affect firmware distributed through the supply chain, multiple PC OEMs may be impacted.”

System owners are encouraged to consult the AMI security advisory and monitor vendor updates closely. Because UEFI code is widely distributed across OEM platforms, the number of affected devices could be significant.

Related Posts:

• Critical AMI BMC Vulnerability: Patch Your ASUS Workstation Now
• CVE-2024-54085: AMI SPx Vulnerability Scores Critical CVSS 10
• Researcher: Spectre CPU flaws can be used to break into the highly privileged CPU mode on Intel x86 systems
• AMD Extends Security Patch for RYZEN 3000, Addressing Critical SMM Vulnerability
• SMM Vulnerabilities in Gigabyte UEFI Firmware Expose Systems to Stealthy Attacks