CVE-2025-14302
Unknown Unknown - Not Provided
DMA Protection Bypass in GIGABYTE Motherboards Enables Memory Access

Publication date: 2025-12-17

Last updated on: 2025-12-17

Assigner: TWCERT/CC

Description
Certain motherboard models developed by GIGABYTE has a Protection Mechanism Failure vulnerability. Because IOMMU was not properly enabled, unauthenticated physical attackers can use a DMA-capable PCIe device to read and write arbitrary physical memory before the OS kernel and its security features are loaded.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-17
Last Modified
2025-12-17
Generated
2026-06-16
AI Q&A
2025-12-17
EPSS Evaluated
2026-06-15
NVD
CVE-2025-14302
EUVD
EUVD-2025-203865
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
gigabyte motherboard *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The vulnerability allows unauthenticated physical attackers to read and write arbitrary physical memory, impacting confidentiality, integrity, and availability of data. This could lead to non-compliance with standards and regulations such as GDPR and HIPAA, which require protection of sensitive data and system integrity. However, specific impacts on compliance are not detailed in the provided resources. [1, 2]

Executive Summary

CVE-2025-14302 is a vulnerability in certain GIGABYTE motherboard models where the IOMMU (Input-Output Memory Management Unit) is not properly enabled. This misconfiguration allows an unauthenticated physical attacker with a PCIe device capable of Direct Memory Access (DMA) to read and write arbitrary physical memory before the operating system kernel and its security features are loaded. [1, 2]

Impact Analysis

This vulnerability can lead to a full compromise of the system's confidentiality, integrity, and availability. An attacker with physical access and a DMA-capable PCIe device can read and write arbitrary physical memory before the OS kernel loads, potentially allowing them to bypass security features and control or disrupt the system. [1, 2]

Mitigation Strategies

The recommended immediate step to mitigate this vulnerability is to update the motherboard firmware to the latest version provided by GIGABYTE. [1, 2]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-14302. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart