New UEFI Flaw Enables Early-Boot DMA Attacks on ASRock, ASUS, GIGABYTE, MSI Motherboards

Security researchers have disclosed a UEFI vulnerability affecting a range of motherboards from ASRock, ASUSTeK Computer, GIGABYTE and MSI, which could allow early‑boot direct memory access (DMA) attacks across architectures that implement UEFI and IOMMU. The flaw stems from a mismatch between the DMA protection status shown by firmware and the actual configuration of the IOMMU during the boot phase, leaving devices with physical access able to read or modify memory before the OS loads.

Found by Nick Peterson and Mohamed Al‑Sharifi of Riot Games, the gap has prompted CERT/CC to warn that attackers could potentially access memory or influence the initial state of the system if firmware is unpatched. The advisory lists four CVEs associated with the issue, including CVE-2025-14304 (ASRock), CVE-2025-11901 (ASUS), CVE-2025-14302 (GIGABYTE), and CVE-2025-14303 (MSI), all with a CVSS score of 7.0.

Vendors have released firmware updates to correct the IOMMU initialization and enforce DMA protections throughout boot, and users are urged to apply patches as soon as they become available, according to CERT/CC. The article notes that a TRX50 platform fix for one of the chipsets is planned for Q1 2026.