Early-Boot Attack: UEFI Flaw in ASRock, ASUS, & MSI Boards Lets Hackers Bypass OS Security via PCIe

According to CERT/CC’s vulnerability note, a flaw in UEFI firmware implementations leaves a window in the early-boot phase where a PCIe device with physical access can read and write system memory before the OS loads, effectively bypassing OS protections. The report notes that although DMA protection is reported as active, the IOMMU is not correctly initialised, enabling pre-boot memory access on affected systems.

Tracked as CVE-2025-14304 with a CVSS of 7.0, the flaw in ASRock motherboards specifically allows unauthenticated physical attackers to read and write arbitrary physical memory before the OS kernel and its security features are loaded; the vulnerability note also lists ASUS (CVE-2025-11901), GIGABYTE (CVE-2025-14302), and MSI (CVE-2025-14303).

The CERT/CC advisory highlights ASRock subsidiaries ASRockRack and ASRockInd among the affected vendors and urges firmware updates be treated with the same urgency as OS patches. It warns that attackers can inject code or extract secrets during pre-boot, a scenario invisible to antivirus and many OS-level security controls, with severe implications for environments where physical security cannot be guaranteed.

Administrators are advised to monitor vendor advisories for updated firmware and to prioritise patching in high-security settings to reduce exposure to pre-boot DMA attacks.