AMI AptioV BIOS (improper input validation, SMM): A local attacker overwrites arbitrary memory and executes code at SMM

Impact

A local attacker overwrites arbitrary memory and executes code at SMM level with scope change. AptioV is the UEFI firmware under a very large fraction of x86 servers, so this is a cross-OEM firmware issue.

Who can reach it

Local low-privilege access to the server.

What to do

AMI ships the fix to OEMs, not to you - obtain the updated BIOS from your board/server vendor (Supermicro, Gigabyte, ASRock Rack, Quanta, Tyan etc.) and flash it. Expect a lag of weeks to months between the AMI advisory and an OEM image for your exact SKU, and expect some SKUs never to get one. Cold reboot per node.

References