Firmware vulnerabilities continue to plague supply chain

Automated firmware-analysis tools and the falling cost of the technical hardware needed to inspect computer processors and memory are leading to a surge in reports of firmware vulnerabilities and motherboard security weaknesses.

In the latest example, motherboard manufacturer Gigabyte disclosed on July 10 that a set of four firmware vulnerabilities had persisted in its platform, even though the original issues — in the firmware provided by independent BIOS vendor AMI — were patched years ago. The issues affect the System Management Mode (SMM) modules on older Intel-based systems, Gigabyte stated in its disclosure.

“Successful exploitation of these vulnerabilities may allow an attacker with local access to elevate privileges or execute arbitrary code within the highly privileged SMM environment,” the company said.

Read more at Dark Reading