CVE-2025-62863
CriticalSummary
A vulnerability in AmpereOne processors allows an out-of-bounds write in the PCIe driver's S-EL0 address space via a malformed SMC call to UEFI-MM. Affects AmpereOne AC03 before 3.5.9.3, AC04 before 4.4.5.2, and M before 5.4.5.1.
Risk Assessment
An attacker could exploit this to write outside the intended memory area, potentially compromising system integrity or escalating privileges within the UEFI environment.
Recommendation
Update the firmware of AmpereOne devices to patched versions (AC03 3.5.9.3, AC04 4.4.5.2, M 5.4.5.1 or later).
Original NVD description (English source)
Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.5.1 allow an incorrectly formed SMC call to UEFI-MM PCIe driver that could result in an out-of-bounds write within PCIe driver’s S-EL0 address space.