before your machine even boots..

Quick Overview

A critical vulnerability, dubbed a "cell-flow flaw," enables pre-boot Direct Memory Access (DMA) attacks on motherboards from Gigabyte, MSI, ASUS, and ASRock because the Pre-Boot DMA Protection feature fails to correctly initialize the IOMMU early in the boot sequence, allowing an attacker with physical access to a malicious PCIe device to read or write kernel memory before the operating system loads and security features become active.

Key Points: The vulnerability, discovered by Riot Games researchers Nick Peterson and Mohamed Al-Sharifi, affects UEFI firmware implementations on motherboards from vendors like Gigabyte, MSI, ASUS, and ASRock. The flaw exploits a window during early boot when the IOMMU (Input-Output Memory Management Unit), which normally prevents rogue DMA access, fails to initialize correctly, even if 'Pre-Boot DMA Protection' is enabled. This failure allows a malicious DMA-capable PCIe device (like a DMA card) physical access to read or modify system memory (RAM) before the OS loads, enabling sophisticated hardware cheats. The exploit works by sending a malicious PCI TLP (Transaction Layer Packet) with a virtual kernel address that the improperly configured IOMMU translates to a physical memory location, bypassing safeguards. Riot Games' kernel-level anti-cheat, Vanguard, blocks Valorant from launching on affected systems until firmware updates are applied. The attack is particularly effective because it occurs before security tools, permission prompts, or alerts can notify the user, as the OS has not yet fully loaded its defenses. The security issue has received multiple identifiers, including CVE-2025-11901 (Asus), CVE-2025-14302 (Gigabyte), CVE-2025-14303 (MSI), and CVE-2025-14304 (ASRock).

Context: The video discusses a significant security vulnerability affecting PC motherboards where flaws in the UEFI firmware implementation allow for Direct Memory Access (DMA) attacks during the early boot process. DMA is a hardware feature allowing devices like graphics cards to read/write RAM directly, bypassing the CPU. The vulnerability specifically targets the 'Pre-Boot DMA Protection' mechanism, which relies on the IOMMU (Input-Output Memory Management Unit) to enforce memory access rules for devices. The discovery was made by researchers associated with Riot Games, whose anti-cheat software, Vanguard, relies on kernel-level integrity checks, making this vulnerability a direct threat to their cheat prevention efforts.