AGESA Boot Loader (ABL) - SPI ROM header input validation (AMD-SB-3003): The AGESA Boot Loader does not properly

Impact

The AGESA Boot Loader does not properly validate SPI ROM headers, so malformed header content is acted on during early boot. Anything that runs before signature enforcement is fully established is disproportionately valuable to an attacker regardless of its CVSS.

Who can reach it

Local, requires SPI ROM write access - root plus flash, a compromised BMC, or supply-chain access.

What to do

Fixed in AMD PI/AGESA firmware and delivered only as an OEM SBIOS package - AMD ships the PI drop to Dell, HPE, Supermicro, Lenovo and the ODMs, who each requalify before releasing BIOS. **Budget one to six months of OEM lag**, and note that several CVEs in this batch are marked 'no fix planned' on Naples (EPYC 7001) - for those the only remediation is retiring the hardware. Applying it means cordon, drain and a full power cycle per node; there is no driver reload, no live patch and no VBIOS step. Enable platform SPI write protection as the compensating control; boot-time parsers cannot be defended from the OS.

References