CVE-2025-14302
DMA Protection Bypass in GIGABYTE Motherboards Enables Memory Access
Publication date: 2025-12-17
Last updated on: 2025-12-17
Assigner: TWCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gigabyte | motherboard | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-693 | The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated physical attackers to read and write arbitrary physical memory, impacting confidentiality, integrity, and availability of data. This could lead to non-compliance with standards and regulations such as GDPR and HIPAA, which require protection of sensitive data and system integrity. However, specific impacts on compliance are not detailed in the provided resources. [1, 2]
Can you explain this vulnerability to me?
CVE-2025-14302 is a vulnerability in certain GIGABYTE motherboard models where the IOMMU (Input-Output Memory Management Unit) is not properly enabled. This misconfiguration allows an unauthenticated physical attacker with a PCIe device capable of Direct Memory Access (DMA) to read and write arbitrary physical memory before the operating system kernel and its security features are loaded. [1, 2]
How can this vulnerability impact me? :
This vulnerability can lead to a full compromise of the system's confidentiality, integrity, and availability. An attacker with physical access and a DMA-capable PCIe device can read and write arbitrary physical memory before the OS kernel loads, potentially allowing them to bypass security features and control or disrupt the system. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate step to mitigate this vulnerability is to update the motherboard firmware to the latest version provided by GIGABYTE. [1, 2]