AMI AptioV UEFI BIOS: A time-of-check-to-time-of-use race in the BIOS leading to arbitrary code execution

Impact

A time-of-check-to-time-of-use race in the BIOS leading to arbitrary code execution with a changed scope. This is the quiet half of the March 2025 AMI advisory - it shipped alongside the CVSS 10.0 MegaRAC authentication bypass that got all the attention, and most operators patched the BMC and forgot the BIOS. Successful exploitation puts attacker code in the firmware boot path, below the OS and below any EDR you run, on a node that will keep passing every host-level integrity check you have.

Who can reach it

Local access with high privileges, high attack complexity. Needs root or kernel code on the host plus the ability to win a timing window during a firmware operation. On bare-metal GPU rentals the tenant holds that privilege by contract; on managed nodes it requires a prior host compromise.

What to do

BIOS update to BKC_5.38 or later - firmware flash plus a full host reboot, per node, gated on your server vendor rebasing. Check specifically whether your March 2025 remediation covered the BIOS: many fleets flashed only the MegaRAC fix for CVE-2024-54085 from the same advisory and left this one open. No config-only mitigation exists for a TOCTOU in firmware.

References