CVE-2025-14303
IOMMU Misconfiguration in MSI Motherboards Enables DMA Memory Access
Publication date: 2025-12-17
Last updated on: 2025-12-17
Assigner: TWCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| msi | motherboard | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-693 | The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects certain MSI motherboard models based on Intel 600/700 chipsets. It is caused by a Protection Mechanism Failure due to the IOMMU (Input-Output Memory Management Unit) not being properly enabled. Because of this, an unauthenticated physical attacker with access to a DMA-capable PCIe device can read and write arbitrary physical memory before the operating system kernel and its security features are loaded. [1, 2]
How can this vulnerability impact me? :
The vulnerability can lead to a full compromise of confidentiality, integrity, and availability of the system. An attacker can read and write arbitrary physical memory, potentially gaining unauthorized access to sensitive data, modifying system memory, or disrupting system operations before the OS kernel and its security features are active. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate step to mitigate this vulnerability is to update the motherboard firmware to the latest version. [1, 2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated physical attackers to read and write arbitrary physical memory, leading to a full compromise of confidentiality, integrity, and availability of data. Such a compromise could result in violations of data protection standards and regulations like GDPR and HIPAA, which require safeguarding sensitive data against unauthorized access and ensuring data integrity and availability. Therefore, organizations using affected MSI motherboards may face compliance risks if this vulnerability is exploited and not mitigated. [1, 2]