NEW UEFI FLAW ENABLES PRE-BOOT ATTACKS FROM GIGABYTE, MSI, ASUS, ASROCK

Summary from the TLDR InfoSec newsletter

Researchers from Riot Games discovered a UEFI flaw that could allow for Direct Memory Access (DMA) capable devices to load before the operating system. DMA allows for PCIe devices to read and write RAM without going through the CPU and relies upon IOMMU for protection. A physically present attacker would need to attach a rogue PCIe device before boot to exploit this vulnerability.