New UEFI flaw enables pre-boot attacks on motherboards from Gigabyte, MSI, ASUS, ASRock

Published:

19 december 2025 om 15:54:48

Alert date:

19 december 2025 om 16:02:35

Source:

bleepingcomputer.com

Operating Systems, Zero-Day Vulnerabilities, Critical Infrastructure

A new UEFI firmware vulnerability affects motherboards from major manufacturers including ASUS, Gigabyte, MSI, and ASRock. The flaw enables direct memory access (DMA) attacks that can bypass early-boot memory protections. This represents a significant security risk as UEFI-level vulnerabilities can compromise systems before the operating system loads, making them particularly dangerous for persistent attacks. The vulnerability affects multiple major motherboard manufacturers, indicating a widespread impact across the PC hardware ecosystem.

Technical details

UEFI firmware implementation vulnerability allows direct memory access (DMA) attacks that bypass early-boot memory protections. The vulnerability causes UEFI firmware to incorrectly show that DMA protection is enabled even when IOMMU did not initialize correctly. During early boot phase, IOMMU must activate before DMA attacks are possible, but the firmware fails to properly configure and enable IOMMU during early hand-off phase. Malicious PCIe devices with physical access can read or modify system memory before operating system-level safeguards are established. Attacks occur before OS boot with no warnings from security tools, permission prompts, or user alerts.

Mitigation steps:

Check for available firmware updates from motherboard manufacturers
Install firmware updates after backing up important data
Check manufacturer security bulletins for specific affected models (ASUS, MSI, Gigabyte, ASRock)
Update Vanguard anti-cheat system if using Riot Games titles
Monitor for VAN:Restriction system prompts in affected games

Affected products:

ASUS motherboards (specific models listed in security bulletins)
Gigabyte motherboards (specific models listed in security bulletins)
MSI motherboards (specific models listed in security bulletins)
ASRock motherboards (specific models listed in security bulletins)
Riot Games Valorant
Riot Games League of Legends