CVE-2025-48516: AGESA Bootloader DDR5 Memory DoS Flaw

CVE-2025-48516 Overview

CVE-2025-48516 is an insecure default configuration vulnerability [CWE-276] affecting DDR5 memory modules initialized by AMD AGESA Bootloader Firmware. The AGESA bootloader leaves the Power Management Integrated Circuit (PMIC) interface on DDR5 modules unprotected during platform initialization. An attacker with local user privileges can interact with the exposed PMIC interface to alter voltage regulation parameters. This abuse can produce a permanent denial of service on the affected memory module or compromise the integrity of stored data. AMD published details in security bulletin AMD-SB-4017.

Critical Impact
Local low-privileged attackers can permanently brick DDR5 memory modules or corrupt memory contents by abusing an unprotected PMIC interface, resulting in hardware-level denial of service.

Affected Products

AMD platforms initialized with affected AGESA Bootloader Firmware
DDR5 memory modules with PMIC interfaces exposed by the bootloader
Systems referenced in AMD Security Bulletin AMD-SB-4017

Discovery Timeline

2026-05-15 - CVE-2025-48516 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2025-48516

Vulnerability Analysis

The vulnerability resides in how AMD AGESA Bootloader Firmware configures DDR5 memory modules during platform initialization. DDR5 introduces an on-module PMIC that manages voltage rails directly on the DIMM. The PMIC exposes a programmable interface allowing software to adjust voltage outputs, secure mode settings, and operational parameters. The AGESA firmware fails to lock or restrict access to this interface after memory training completes. As a result, the PMIC remains writable from the running operating system through standard SMBus or I3C transactions exposed by the platform.

A local attacker who can issue these transactions can drive the DRAM voltage outside specification, disable the PMIC's secure mode, or write irreversible one-time-programmable settings. These actions can render the DIMM inoperable or cause silent data corruption that undermines memory integrity. The attack does not require remote network access or user interaction.

Root Cause

The root cause is an insecure default configuration state [CWE-276]. The AGESA bootloader does not assert the PMIC's secure mode register or apply write protection before transferring control to the operating system. JEDEC DDR5 specifications define a secure mode that prevents runtime modification of critical PMIC parameters, but the firmware does not enable this protection by default.

Attack Vector

Exploitation requires local low-privileged access to the host. The attacker issues PMIC commands through the platform's system management bus to modify voltage regulator setpoints or lock bits. No verified public exploit code is available. Technical specifics are described in the AMD Security Bulletin AMD-SB-4017.

Detection Methods for CVE-2025-48516

Indicators of Compromise

Unexpected memory errors, machine check exceptions, or DIMM failures following local administrative or driver-level activity
Userland or kernel processes accessing SMBus, I2C, or I3C interfaces tied to DIMM SPD or PMIC addresses
Loading of unsigned or unusual kernel drivers that expose low-level bus access primitives

Detection Strategies

Monitor for processes invoking system management bus drivers such as i2c-dev, i2c-piix4, or vendor PMIC tools outside maintenance windows
Audit firmware versions against the fixed AGESA releases listed in AMD-SB-4017 to identify systems still exposing the unprotected PMIC interface
Track hardware telemetry from baseboard management controllers for anomalous DIMM voltage readings or PMIC status changes

Monitoring Recommendations

Enable kernel auditd rules for opens against /dev/i2c-* and /dev/mem on Linux systems
Collect Windows driver load events (Event ID 6) for drivers providing SMBus access and correlate with privilege context
Forward hardware health logs from IPMI or Redfish endpoints into centralized log analytics to detect voltage excursions

How to Mitigate CVE-2025-48516

Immediate Actions Required

Inventory all AMD platforms and identify systems running affected AGESA Bootloader Firmware versions referenced in AMD-SB-4017
Apply the AGESA firmware update from the system OEM as soon as it is published for the affected platform
Restrict local administrative access and limit the ability to load kernel drivers that expose SMBus or I3C interfaces

Patch Information

AMD has published fixed AGESA Bootloader Firmware through OEM channels. Refer to the AMD Security Bulletin AMD-SB-4017 for the list of corrected AGESA versions and contact the system manufacturer for BIOS updates that integrate the fix. The patch enables PMIC secure mode and locks the interface before handing control to the operating system.

Workarounds

Remove or block unprivileged access to SMBus and I3C device nodes used to reach the PMIC on DDR5 DIMMs
Enforce signed driver requirements and application allowlisting to prevent loading of tools capable of issuing PMIC writes
Where feasible, disable user-mode memory tuning utilities and overclocking software that interact with the PMIC

bash

# Configuration example: restrict access to SMBus device nodes on Linux
chmod 600 /dev/i2c-*
chown root:root /dev/i2c-*
rmmod i2c-dev 2>/dev/null
echo 'blacklist i2c-dev' > /etc/modprobe.d/blacklist-i2c-dev.conf