EUVD-2025-21142CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3Description
A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control the RBX register, which is used to derive pointers (OcHeader, OcData) passed into power and thermal configuration logic. These buffers are not validated before performing multiple structured memory writes based on OcSetup NVRAM values, enabling arbitrary SMRAM corruption and potential SMM privilege escalation.
Analysis
CVE-2025-7029 is a critical SMRAM corruption vulnerability in software SMI handlers that allows local attackers with high privileges to achieve arbitrary memory writes and potential SMM privilege escalation. The vulnerability exists in SwSmiInputValue 0xB2 handler where attacker-controlled RBX register values are used to derive unvalidated pointers for power and thermal configuration operations. This affects firmware-level security boundaries and could enable complete system compromise, though exploitation requires elevated privileges and no public exploit code or active KEV exploitation has been reported at this time.
Technical Context
This vulnerability resides in System Management Mode (SMM) firmware, specifically in the Software SMI (System Management Interrupt) handler responsible for power and thermal management configuration. The root cause is insufficient input validation (CWE-20 equivalent) on attacker-controlled registers used for pointer derivation. The SwSmiInputValue 0xB2 SMI service accepts RBX register values without bounds checking and uses these values to calculate memory pointers (OcHeader, OcData) that are subsequently dereferenced and written to via OcSetup NVRAM configuration values. This violates secure coding principles for privileged firmware execution contexts where register inputs must be treated as untrusted. The vulnerability affects firmware implementations across multiple OEM platforms that utilize this SMI handler pattern for overclocking and power/thermal management, typically found in Intel-based systems where UEFI/SMM integration provides this functionality.
Affected Products
Specific affected products are not enumerated in the provided data. However, based on the technical description, affected products likely include: (1) Intel-based firmware implementations with Software SMI handler support for power/thermal management, (2) OEM BIOS/UEFI implementations including SwSmiInputValue 0xB2 handler, (3) Systems with OcSetup NVRAM configuration support for overclocking features. Typical affected platforms would be consumer/enthusiast Intel motherboards and workstations with UEFI firmware from OEMs (Gigabyte, ASUS, ASRock, MSI, etc.) and enterprise systems. CPE data specific to affected versions was not provided in the source material - vendor advisories should be consulted for precise version mapping. No vendor advisory links or patch availability information was provided.
Remediation
Without vendor advisory links or patch release information in the provided data: (1) Firmware vendors should release BIOS/UEFI updates implementing input validation for RBX register values in SwSmiInputValue 0xB2 handler, including bounds checking on derived pointer calculations, (2) Validate all pointer dereferences against a safe memory range whitelist before performing memory operations, (3) Implement pointer encryption/signing to prevent RBX-based pointer manipulation, (4) Temporary mitigation: restrict SMM-accessible NVRAM write permissions and limit user access to power/thermal management features in firmware settings. End-users should: (a) check OEM websites (Intel, motherboard manufacturers) for firmware updates addressing CVE-2025-7029, (b) apply patches immediately upon availability given the severity, (c) audit SMM access logs for suspicious SMI calls on vulnerable systems, (d) disable non-essential SMI handlers if supported by firmware. Specific patch versions and advisory URLs require vendor disclosure.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today