CVE-2024-42442: high-severity vulnerability in AMI AptioV
Runtime Service Access outside SMRAM
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A vulnerability in APTIO BIOS allows attackers to write data outside the intended memory buffer, potentially executing code in System Management Mode (a privileged area that controls the computer at a very low level). This could give attackers full control over the system.
CWE-119 buffer overflow in APTIO BIOS permits out-of-bounds memory write via network-accessible vectors, enabling arbitrary code execution in SMM context. The vulnerability requires network access and may bypass isolation controls that separate privileged firmware execution from user-mode operations.
In the same product, most dangerous first.