Major GIGABYTE BIOS Vulnerabilities

Stigg · Dec 30, 2021

GIGABYTE owners are being advised to update their BIOSes due to major vulnerabilities.
It appears that it affects both Intel and AMD systems. There are articles about it everywhere.

This is the BIOS update description for my motherboard.

Major vulnerabilities updates. Customers are strongly encouraged to update to this release at the earliest.
Credits to "Assaf Carlsbad and Itai Liba from SentinelOne"
Introduce capsule BIOS support starting this version.
Customers will NOT be able to reverse to previous BIOS version due to major vulnerabilities concerns.

I'm a bit concerned not being able to reverse to previous versions as I see some people are having problems.
Also, this BIOS archive file contains different files to previous ones. Normally, I just use Q-Flash, or to a lesser extent @ BIOS.

I've attached the PDF file that comes with it. Maybe someone can make sense of it for me.

PerpetualCycle · Dec 30, 2021

From what I found in the threads about this, they are probably are these two Intel vulnerabilities:

INTEL-SA-00562

www.intel.com

FWIW, both require local access to your computer to exploit. What "local access" means is that an attacker requires prior access to the vulnerable system. So there has to be another means to get access to your system first. So it requires an additional network or physical exploitation.

Stigg · Dec 30, 2021

geneo said:
From what I found in the threads about this, they are probably are these two Intel vulnerabilities:

INTEL-SA-00562

INTEL-SA-00562

www.intel.com

FWIW, both require local access to your computer to exploit. What "local access" means is that an attacker requires prior access to the vulnerable system. So there has to be another means to get access to your system first. So it requires an additional network or physical exploitation.

On the GIGABYTE Support Forum, a forum member posted a reply from GIGABYTE Technical Support Team which appears to indicate that it also affects AMD systems.

X570 AORUS XTREME F35D Major vulnerabilities updates | GIGABYTE USA Forum

Hello, suddenly the changelog for F35D shows some new information:

forum.gigabyte.us

PerpetualCycle · Dec 30, 2021

Yeah, I was aware of that, but didn't have a reference for the AMD side.

Stigg · Dec 30, 2021

I guess my biggest query is, why have they instructed a different BIOS update method for this particular BIOS update?

Over the years, I have updated GIGABYTE BIOSes on numerous motherboards and laptops, and the procedure has always been the same. But this particular BIOS update includes flash.nsh and an EFI sub-folder containing BOOTX64.EFI and startup.nsh along with specific instructions (attached in opening post).

And apart from that, it's irreversible according to GIGABYTE.

PerpetualCycle · Dec 30, 2021

Well, I have some theories I was going to post, but I am not going to speculate. But perhaps their BIOS update delivery was the vulnerability that gives the initial access, IDK.

RFS · Dec 30, 2021

I have updated my Z370 BIOS with this update and have had no problems at all with it.

Stigg · Dec 30, 2021

RFS said:
I have updated my Z370 BIOS with this update and have had no problems at all with it.

What update method did you use?
Did you follow the included PDF instructions?

bikemanI7 · Dec 30, 2021

Updated the Day it came out for my Gigabyte B460M_DS3H, ((PC Used Daily, various tasks, no problems seen here)) Used daily for a good 12-16 hours, gaming, listening to music, little video work, system maintenance tasks, streaming audio sometimes at night to bluetooth headset

Stigg · Dec 30, 2021

I am back from the BIOS update.

I updated using the recommended EFI shell mode method. It all went well.
Although the computer restarted about five times before it completed.

RFS · Dec 30, 2021

Stigg said:
What update method did you use?
Did you follow the included PDF instructions?

I used the Q-FLASH method. Put the update file on a FAT32 USB stick, and booted the PC holding down the END key. All pretty simple from there.

You need to bear in mind that when you update the BIOS, it returns to standard defaults. So I had to re-enable secure boot, TPM etc and also turn off fast boot.

See instructions here.

Stigg · Dec 30, 2021

RFS said:
I used the Q-FLASH method. Put the update file on a FAT32 USB stick, and booted the PC holding down the END key. All pretty simple from there.

You need to bear in mind that when you update the BIOS, it returns to standard defaults. So I had to re-enable secure boot, TPM etc and also turn off fast boot.

See instructions here.

I usually use Q-Flash too. But the reason I went with EFI Shell Mode is because this BIOS update included specific instructions and extra files, including an EFI sub-folder. I attached the instructions in my opening post. I have never seen this before in previous updates. Did your BIOS update not have these specific instructions, extra files and EFI sub-folder?

By the way, the previous BIOS update last month addressed the TPM issue and enabled it as the default setting.

1. Change default status of Intel® Platform Trust Technology (Intel® PTT) to Enabled for addressing basic Windows 11 requirements (Enable TPM 2.0 on your PC)
2. Enable Resizable Base-Address Register (Resizable-BAR) option to enhance GPU performance
3. Enhance RAID AIC compatibility
4. Addresses Intel voltage-based overclocking functionality on new Intel® Core™ X-series 10000 processors (see more: https://www.intel.com/content/www/us/en/ support/articles/000055751/processors/intel-core-processors.html)
5. Improve 4000MHz memory compatibility

Dru2 · Jan 3, 2022

Stigg said:
GIGABYTE owners are being advised to update their BIOSes due to major vulnerabilities.
It appears that it affects both Intel and AMD systems. There are articles about it everywhere.

I'm a bit concerned not being able to reverse to previous versions as I see some people are having problems.
Also, this BIOS archive file contains different files to previous ones. Normally, I just use Q-Flash, or to a lesser extent @ BIOS.

Gigabyte Z390 Aorus Xtreme motherboard - I updated my BIOS; my system didn't blow up though it did appear to clear my TPM. Outside of that all good.

Also, if you have a dual BIOS setup up, you can always revert to the backup. When I did my BIOS update, I was asked if I wanted to update the backup and I chose no.

Anyway, just used Q-Flash to update the BIOS. Didn't get/see any extra instructions for extra stuff.

Stigg · Jan 3, 2022

Dru2 said:
Gigabyte Z390 Aorus Xtreme motherboard - I updated my BIOS; my system didn't blow up though it did appear to clear my TPM. Outside of that all good.

Also, if you have a dual BIOS setup up, you can always revert to the backup. When I did my BIOS update, I was asked if I wanted to update the backup and I chose no.

Anyway, just used Q-Flash to update the BIOS. Didn't get/see any extra instructions for extra stuff.

The specific instructions, extra files and EFI sub-folders are these posted below. The PDF instructions are in my opening post.
As I have previously said, I have never had these specific instructions, extra files and EFI sub-folders in any previous BIOS update. My guess is it was designed to clear the vulnerabilities.

GIGABYTE X299X DESIGNARE 10G (Rev. 1.0) BIOS vF3j.png

I am glad yours worked without any problems. :)

Dru2 · Jan 3, 2022

Stigg said:
The specific instructions, extra files and EFI sub-folders are these posted below. The PDF instructions are in my opening post.
As I have previously said, I have never had these specific instructions, extra files and EFI sub-folders in any previous BIOS update. My guess is it was designed to clear the vulnerabilities.

View attachment 17562 View attachment 17563

I am glad yours worked without any problems. :)

Yeah, I used to check the files, but just extract and update now. Gigabyte usually notifies on the download page you if "special precautions" are needed for an update.

Major GIGABYTE BIOS Vulnerabilities

Well-known member

Attachments

My Computers

Syzygy

My Computers

Well-known member

My Computers

Syzygy

My Computers

Well-known member

My Computers

Syzygy

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Similar threads