New UEFI Vulnerability Exposes ASRock, ASUS, GIGABYTE, and MSI Motherboards to DMA Attacks
- Securityish
- Threats & Incidents
Quick Summary
A newly discovered UEFI vulnerability affects motherboards from ASRock, ASUS, GIGABYTE, and MSI, allowing early-boot direct memory access (DMA) attacks. This flaw, identified by researchers at Riot Games, stems from improper IOMMU configuration during the boot phase, potentially enabling attackers to access sensitive data before operating system protections are in place. Users of affected motherboards should apply firmware updates promptly to mitigate risks.
The Securityish Brief
Recent findings reveal that certain motherboards from ASRock, ASUS, GIGABYTE, and MSI are vulnerable to early-boot DMA attacks due to a UEFI flaw. Discovered by Nick Peterson and Mohamed Al-Sharifi of Riot Games, this vulnerability affects systems that fail to properly configure the input-output memory management unit (IOMMU) during the critical boot phase. The issue has been assigned multiple CVE identifiers, including CVE-2025-14304, CVE-2025-11901, CVE-2025-14302, and CVE-2025-14303, all with a CVSS score of 7.0, indicating a high severity level.
This vulnerability allows a malicious PCIe device with physical access to read or modify system memory before the operating system’s security features are loaded. As a result, attackers could potentially access sensitive data or alter system states, undermining the integrity of the boot process. The affected motherboards include various models using Intel and AMD chipsets, highlighting a widespread risk across different platforms.
Understanding the Risks
The implications of this vulnerability are significant, particularly for environments where physical access to systems cannot be controlled. Attackers could exploit this flaw to inject malicious code or extract sensitive information, making it crucial for users and organizations to remain vigilant. The CERT Coordination Center emphasizes the importance of promptly applying firmware updates released by the affected vendors to address the IOMMU initialization sequence.
Organizations should also consider implementing hardware security best practices to mitigate risks associated with physical access to systems. This includes ensuring that only trusted personnel have physical access to sensitive devices and regularly monitoring for unauthorized access attempts.
What Users Should Do
For everyday users, this situation serves as a reminder of the importance of keeping firmware up to date. Users should check for updates from their motherboard manufacturers and apply them as soon as they become available. Additionally, being aware of the potential for physical attacks can help users take proactive measures to secure their devices.
In summary, this UEFI vulnerability underscores the necessity for robust security practices in both personal and organizational contexts. By staying informed and proactive, users can better protect themselves against emerging threats in the cybersecurity landscape.
Key Takeaways
- Check for firmware updates from ASRock, ASUS, GIGABYTE, or MSI and apply them immediately.
- Limit physical access to devices to prevent potential exploitation of this vulnerability.
- Regularly review and enhance hardware security practices within your organization.
- Stay informed about cybersecurity threats and vulnerabilities relevant to your hardware.
- Monitor for any unusual behavior on your systems that may indicate a security breach.
Key Terms & Concepts
- UEFI: In this article, UEFI refers to the Unified Extensible Firmware Interface, which initializes hardware before the operating system loads.
- DMA: DMA stands for Direct Memory Access, a feature that allows devices to access system memory without involving the CPU.
- IOMMU: IOMMU refers to the Input-Output Memory Management Unit, which manages memory access for DMA-capable devices.
- CVE: CVE stands for Common Vulnerabilities and Exposures, a system for identifying and cataloging publicly known cybersecurity vulnerabilities.
Read the original article here: https://thehackernews.com/2025/12/new-uefi-flaw-enables-early-boot-dma.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
