AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
An attacker present in the same network (adjacent network) can send specially crafted data to the BMC (Baseboard Management Controller) component, causing a stack-based buffer overflow (CWE-121, CWE-787). The overflow results from insufficient validation of the size of data being written to a fixed-size buffer. The attack does not require authentication or user interaction.
An attacker can gain unauthorized access to sensitive data, modify system state, or cause system unavailability. In the most severe scenario, remote code execution (RCE) in the context of the vulnerable BMC component is possible.
Patches available from the vendor should be applied in accordance with references (AMI security bulletin AMI-SA-2023010 available on AMI website). Due to the network attack vector (adjacent network), it is also recommended to isolate BMC/IPMI interfaces from production networks and restrict access to these interfaces to trusted hosts only.
AMI MegaRAC SPx — versions indicated in vendor references (see AMI-SA-2023010 bulletin)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HAmi Megarac Sp X
OSAmi12 – 12.7 (excl.)13 – 13.6 (excl.)
Related vulnerabilities
AMI MegaRAC SPx — zdalne ominięcie uwierzytelnienia w interfejsie Redfish BMC
AMI MegaRAC SPx — stack-based buffer overflow w BMC przez sieć lokalną
AMI MegaRAC SPx12 BMC — pominięcie uwierzytelnienia przez spoofing nagłówka HTTP
AMI MegaRAC SPx — niewystarczająca weryfikacja autentyczności danych
AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to d...