Critical · published December 16, 2025
🔥 A poorly crafted SMC call could open the door to an out-of-bounds write in your AmpereOne devices! Think of it like a waiter who accidentally carries the wrong order to the kitchen — when the chef gets confused, a disastrous mix-up can ruin the entire meal. In this case, the S-EL0 address space is left vulnerable to unexpected modifications, just waiting for someone to exploit it! An attacker could potentially manipulate the PCIe driver, leading to unauthorized data modifications or even system crashes. This vulnerability poses a significant risk, as it can jeopardize the integrity and stability of the devices, possibly allowing for malicious access to sensitive operations.
Think of it like a waiter who accidentally carries the wrong order to the kitchen — when the chef gets confused, a disastrous mix-up can ruin the entire meal. In this case, the S-EL0 address space is left vulnerable to unexpected modifications, just waiting for someone to exploit it! This vulnerability in AmpereOne devices stems from improper handling of SMC calls to the UEFI-MM PCIe driver, which leads to an out-of-bounds write in the driver's S-EL0 address space. Without proper validation, this flaw permits an attacker to influence memory in critical areas.
An attacker could potentially manipulate the PCIe driver, leading to unauthorized data modifications or even system crashes. This vulnerability poses a significant risk, as it can jeopardize the integrity and stability of the devices, possibly allowing for malicious access to sensitive operations. To combat this vulnerability, update your AmpereOne AC03 devices to version 3.5.9.3, AC04 devices to version 4.4.5.2, and M devices to version 5.4.5.1 immediately. Ensure all devices are configured to only accept well-formed calls, and monitor your systems for any unusual behavior. You've got this! Follow these steps and fortify your defenses against this threat! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| amperecomputing/ampereone_a192-32m_firmware | < 5.4.5.1 | 5.4.5.1 |
| amperecomputing/ampereone_a192-26m_firmware | < 5.4.5.1 | 5.4.5.1 |
| amperecomputing/ampereone_a160-28m_firmware | < 5.4.5.1 | 5.4.5.1 |
| amperecomputing/ampereone_a144-33m_firmware | < 5.4.5.1 | 5.4.5.1 |
| amperecomputing/ampereone_a144-26m_firmware | < 5.4.5.1 | 5.4.5.1 |
| amperecomputing/ampereone_a96-36m_firmware | < 5.4.5.1 | 5.4.5.1 |
| amperecomputing/ampereone_a96-36x_firmware | < 4.4.5.2 | 4.4.5.2 |
| amperecomputing/ampereone_a128-34x_firmware | < 4.4.5.2 | 4.4.5.2 |
| amperecomputing/ampereone_a144-24x_firmware | < 4.4.5.2 | 4.4.5.2 |
| amperecomputing/ampereone_a144-27x_firmware | < 4.4.5.2 | 4.4.5.2 |
| amperecomputing/ampereone_a160-28x_firmware | < 4.4.5.2 | 4.4.5.2 |
| amperecomputing/ampereone_a192-26x_firmware | < 4.4.5.2 | 4.4.5.2 |
| amperecomputing/ampereone_a192-26x_firmware | < 3.5.9.3 | 3.5.9.3 |
| amperecomputing/ampereone_a192-32x_firmware | < 3.5.9.3 | 3.5.9.3 |