AMI AptioV UEFI BIOS: Improper handling of insufficient permissions in the BIOS lets a low-privileged local user

Impact

Improper handling of insufficient permissions in the BIOS lets a low-privileged local user escalate their authorization, with integrity and availability impact that AMI scores as reaching the subsequent system too. What makes this one worth prioritising over its neighbours is that AMI's own CVSS vector marks exploit maturity as proof-of-concept - meaning working exploit code exists publicly, not just a theoretical write-up. It is also the newest entry in AMI's published series, so ODM rebased images are the least likely to be available.

Who can reach it

Local access with only low privileges required and no user interaction. That is a notably low bar for a firmware bug - it does not need root, so an unprivileged process or a compromised service account on the host is enough to start escalating toward firmware.

What to do

BIOS update to AptioV_5.041 or later: firmware flash plus a full host reboot, per node, and expect the longest ODM lag of anything in this cluster because the advisory is recent. No config-only fix. Given the low privilege requirement, the interim control is ordinary host hardening - reduce what unprivileged local code exists on GPU nodes at all, and treat any node where untrusted tenant code runs as already exposed until the BIOS is updated.

References