CriticalPublic exploit

Improper SPI Flash Write Protection in GIGABYTE BRIX UEFI Firmware

IdentifiersCVE-2017-3197CWE-693· Protection Mechanism Failure

CVE-2017-3197 is a firmware protection failure in GIGABYTE BRIX UEFI firmware affecting the GB-BSi7H-6500 platform running firmware version F6 and the GB-BXi7-5775 platform running firmware version F2. The firmware does not securely implement critical BIOS and SPI flash protection mechanisms, including BIOSWE, BLE, SMM_BWP, and PRx protected ranges. Because these controls are not correctly enforced, the platform BIOS is not adequately protected against arbitrary write access, allowing modification of the SPI flash contents. This weakness can permit an attacker with local code execution to alter firmware and install malicious components that execute before the operating system, or to corrupt firmware and render the platform unbootable.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can allow a local authenticated attacker to write to system firmware and execute arbitrary code with firmware-level privileges. This enables highly persistent compromise, including installation of firmware rootkits or bootkits that survive operating system reinstallation and can execute before OS security controls. The flaw can also be abused to corrupt the SPI flash image, causing denial of service or potentially permanent loss of platform functionality if the firmware becomes unusable.

Mitigation

If you can’t patch tonight, do this now.

No complete workaround is available for affected unsupported systems. Limit local administrative access, restrict execution of untrusted code on affected hosts, and closely monitor for attempts to access or modify firmware. Where possible, deploy stronger platform boot protections such as Secure Boot, Verified Boot, or Measured Boot to reduce the value of unauthorized firmware modification, although these measures do not correct the underlying write-protection failure. For unsupported GB-BXi7-5775 devices, replacement is the most reliable risk-reduction measure.

Remediation

Patch, then assume compromise.

Upgrade affected GB-BSi7H-6500 systems from firmware version F6 to firmware version F7. For GB-BXi7-5775, no vendor remediation is available because the platform is end of life. Organizations using affected unsupported systems should plan hardware replacement or retirement where firmware correction cannot be obtained.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

GIGABYTE TechnologyBrix Uefi Firmware (Gb-Bsi7h-6500)operating_system

GIGABYTE TechnologyBrix Uefi Firmware (Gb-Bxi7-5775)operating_system

GIGABYTE TechnologyGb-Bsi7h-6500 Firmwareoperating_system

GIGABYTE TechnologyGb-Bxi7-5775 Firmwareoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

vmware security blogNews

Jun 15, 2021

Detecting UEFI Bootkits in the Wild (Part 1) - VMware Security Blog - VMware

A firmware-related vulnerability mentioned as a possible means to disable BIOS write protections during LoJax bootkit installation.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence1

Every observed campaign linking this CVE to a named adversary.

Associated malware1

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity