BMC Firmware Bugs Plague Server Supply Chain, 7 Vendors Impacted

guest · Jul 17, 2019

Firmware Bugs Plague Server Supply Chain, 7 Vendors Impacted
Lenovo, Acer and five additional server manufacturers are hit with supply-chain bugs buried in motherboard firmware
July 17, 2019
https://threatpost.com/firmware-bugs-plague-supply-chain/146519/

Two firmware vulnerabilities impacting Lenovo, Acer and five additional server brands allow adversaries to brick servers, run arbitrary code on targeted systems and maintain a persistent foothold – surviving even an operating system reinstallation.

The bugs are tied to Gigabyte motherboards used in the vulnerable servers. The culprit is firmware for a motherboard component called a Baseboard Management Controller (BMC), which is used for subsystem management and monitoring. Server-makers using the vulnerable BMC firmware are Lenovo, Acer, AMAX, Bigtera, Ciara, Penguin Computing and sysGen.

“This highlights an important challenge for the industry. Most hardware vendors do not write their own firmware and instead rely on their supply-chain partners,” researchers wrote.
Breaking Down the Bugs
The first of the two vulnerabilities needed to carry out an attack is a lack of authentication within the BMC firmware. [...] The second bug is a command-injection bug.
In this respect, the flaws would require advanced work by an adversary. However, once in, the stealth and persistent nature of the flaw allows for an attacker to hide on a system’s flash chips. Neither a software upgrade or swapping out local storage would mitigate the attack vector.
Click to expand...

guest · Jul 17, 2019

mood said: ↑

Firmware Bugs Plague Server Supply Chain, 7 Vendors Impacted
Click to expand...

Eclypsium: Vulnerable Firmware in the Supply Chain of Enterprise Servers
(PDF - 705 KB): https://eclypsium.com/wp-content/uploads/2019/07/Vulnerable-Firmware-in-the-Supply-Chain.pdf

DISCLOSURE TIMELINE
These issues were reported as follows:
07/25/2018: Lenovo: Notified of insecure BMC firmware updates
07/27/2018: Lenovo: Notified of BMC Command Injection
11/15/2018: Lenovo: Released patch and advisory for BMC Command Injection
03/15/2019: Gigabyte: Notified of both issues
04/05/2019: Vertiv: Notified of both issues
04/19/2019: Additional details provided to Gigabyte and Vertiv
05/08/2019: Gigabyte: Released patch for BMC Command Injection for AST2500 series without advisory
Click to expand...

Log in or Sign up

BMC Firmware Bugs Plague Server Supply Chain, 7 Vendors Impacted

guest Guest

guest Guest

Log in or Sign up

BMC Firmware Bugs Plague Server Supply Chain, 7 Vendors Impacted

guest Guest

guest Guest

Useful Searches