CVE-2025-62862
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
AmpereOne AC03, AC04, and M devices allow an incorrectly formed SMC call to UEFI-MM Boot Error Record Table driver, potentially resulting in out-of-bounds read (leaking Secure-EL0 info) or out-of-bounds write (corrupting Secure or Non-Secure memory).
Risk Assessment
A local attacker may gain access to sensitive Secure-EL0 information or corrupt system memory, potentially leading to system integrity compromise and data leakage.
Recommendation
Update AmpereOne firmware to patched versions and restrict access to SMC calls.
Other vulnerabilities in AmpereOne
Original NVD description (English source)
Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.5.1 allow an incorrectly formed SMC call to UEFI-MM Boot Error Record Table driver that could result in (1) an out-of-bounds read which leaks Secure-EL0 information to a process running in Non-Secure state or (2) an out-of-bounds write which corrupts Secure or Non-Secure memory, limited to memory mapped to UEFI-MM Secure Partition by the Secure Partition Manager.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS