CVE-2025-14302: GIGABYTE Motherboard DMA Attack Vulnerability

CVE-2025-14302 Overview

CVE-2025-14302 is a protection mechanism failure vulnerability affecting certain GIGABYTE motherboard models. The firmware fails to properly enable the Input-Output Memory Management Unit (IOMMU) during early boot. An unauthenticated attacker with physical access can connect a Direct Memory Access (DMA) capable PCIe device and read or write arbitrary physical memory before the operating system kernel and its security features are loaded. This pre-boot window allows the attacker to bypass kernel-level defenses, including Kernel DMA Protection, and compromise system integrity. The weakness is classified under [CWE-693: Protection Mechanism Failure].

Critical Impact
A physically present attacker can achieve full read/write access to system memory via a malicious PCIe or Thunderbolt device, undermining Secure Boot assumptions and enabling firmware implants, credential theft, or persistent pre-OS compromise.

Affected Products

Certain GIGABYTE motherboard models (specific SKUs listed in the vendor advisory)
Systems relying on GIGABYTE firmware without IOMMU enabled during pre-boot
Platforms exposing external DMA-capable interfaces such as Thunderbolt or open PCIe slots

Discovery Timeline

2025-12-17 - CVE-2025-14302 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14302

Vulnerability Analysis

The vulnerability stems from firmware that does not activate the IOMMU during the platform initialization phase. The IOMMU is the hardware component responsible for restricting the physical memory regions that PCIe devices can access via DMA. When the IOMMU remains disabled, any DMA-capable peripheral is granted unrestricted access to system RAM.

Attackers can exploit this window before the operating system loads its own DMA protections. Modern OS-level defenses such as Windows Kernel DMA Protection and Linux IOMMU passthrough rely on firmware to hand off a properly initialized IOMMU. When that handoff is missing, the OS cannot retroactively secure memory that was already exposed during boot.

An attacker with brief physical access can insert a rogue PCIe card, Thunderbolt device, or purpose-built DMA tool such as a PCILeech-compatible adapter. The device then issues DMA transactions targeting arbitrary physical addresses, reading secrets or writing malicious payloads into kernel structures.

Root Cause

The root cause is a firmware configuration flaw. The affected GIGABYTE motherboards ship with IOMMU disabled or improperly initialized during the pre-boot environment. This violates the defense-in-depth expectation that DMA remapping is enforced continuously from platform reset through OS runtime.

Attack Vector

Exploitation requires physical proximity and a DMA-capable device connected to a PCIe lane or an external interface bridging to PCIe. The attacker powers on or reboots the system with the device attached and issues memory read/write commands through standard DMA transactions. No credentials, user interaction, or software vulnerability in the OS is required. Because the attack occurs before OS load, it is invisible to endpoint agents running at OS runtime.

No public proof-of-concept exploit is currently available for this specific advisory. Refer to the Gigabyte Security Advisories and the TW-CERT Security Advisory for vendor-supplied technical detail.

Detection Methods for CVE-2025-14302

Indicators of Compromise

Unexpected PCIe devices enumerated in firmware logs or under lspci output after a suspicious physical access event
Unexplained modifications to kernel memory regions, boot loaders, or Secure Boot variables detected by integrity tools
Firmware event logs showing DMA remapping units reported as disabled or absent at boot

Detection Strategies

Audit firmware configuration for IOMMU/VT-d/AMD-Vi status using vendor tooling or dmesg | grep -i iommu on Linux and msinfo32 on Windows to confirm Kernel DMA Protection state
Correlate physical access events, such as chassis intrusion alerts or badge logs, with subsequent unexplained reboots or PCIe device changes
Deploy platform integrity attestation, including TPM-backed measured boot, to identify unauthorized pre-OS modifications

Monitoring Recommendations

Enable and forward UEFI event logs and TPM PCR measurements to a centralized log platform for anomaly review
Monitor endpoint telemetry for post-boot signs of implants, such as unsigned drivers loading, unexpected SMM callbacks, or credential extraction from LSASS
Track hardware inventory changes and alert on new PCIe vendor/device IDs appearing on protected systems

How to Mitigate CVE-2025-14302

Immediate Actions Required

Apply the firmware update published by GIGABYTE for the affected motherboard models as listed in the Gigabyte Security Advisories
Enable IOMMU/VT-d/AMD-Vi in BIOS setup on all affected systems once the updated firmware is installed
Enforce a firmware administrator password to prevent attackers from disabling the IOMMU setting through the BIOS menu
Restrict physical access to servers, workstations, and any systems exposing external Thunderbolt or open PCIe slots

Patch Information

GIGABYTE has published BIOS updates addressing the IOMMU initialization defect. Administrators should consult the Gigabyte Security Advisories portal for the list of affected models and corresponding firmware versions, and the TW-CERT Security Incident Report for coordinated disclosure detail.

Workarounds

Disable or physically block unused Thunderbolt and external PCIe interfaces via BIOS settings where firmware updates cannot be applied immediately
Enable Windows Kernel DMA Protection and Linux iommu=force boot parameters as defense-in-depth once firmware exposes a functional IOMMU
Use chassis intrusion detection and tamper-evident seals on high-value systems to deter and detect physical tampering

bash

# Verify IOMMU status on Linux after applying firmware update
dmesg | grep -e DMAR -e IOMMU

# Force IOMMU enforcement at boot (add to kernel command line in /etc/default/grub)
GRUB_CMDLINE_LINUX="intel_iommu=on iommu=force"
sudo update-grub

# Verify Kernel DMA Protection on Windows (run in elevated PowerShell)
Get-CimInstance -ClassName Win32_DeviceGuard | Select-Object -ExpandProperty SecurityServicesRunning