Privilege escalation via raceable SMM buffer validation

BIOS firmware TOCTOU in affected Siemens industrial PCs allows privileged local users to escalate privileges through untrusted code. The SPI SMM handler validates fields through a raceable external communication buffer, then copies data using values from a different unvalidated snapshot. Exploitation requires high privileges and a DMA-capable agent, such as malicious firmware or a PCIe peripheral, and can corrupt SMRAM to gain SMM execution.