Power Management Controller (PMC) firmware in systems using Intel CSME 11.x/12.0 or Intel SPS 4.x: An administrative

Impact

An administrative attacker can reach the platform's Power Management Controller firmware. The PMC owns the platform power state machine and rails - so this is one of the few software-reachable paths with a direct physical outcome: forced or blocked power transitions on a node, and manipulation of the power/thermal control loop that the rest of the platform trusts. On GPU nodes drawing 6-10 kW, an attacker who can hold a node in the wrong power state or misreport its budget to Node Manager can trip breakers at the rack or hall level rather than merely killing one job. The PMC firmware also lives outside the host OS image, so a modification persists across reimage and tenant handoff.

Who can reach it

An attacker with administrative privileges on the platform - local root on the host reaching CSME/SPS via HECI, or an administrator on the management path.

What to do

CSME/SPS firmware bundle including the PMC firmware, delivered by the OEM (Dell, HPE, Supermicro, Lenovo, Gigabyte, Quanta) as a BIOS/ME package. Host reboot and job drain required; HPE's bundle for this advisory came out well after Intel's September 2018 date, which is the normal pattern. There is no runtime mitigation - PMC firmware cannot be disabled. Operationally, pair the rollout with independent power telemetry at the PDU/branch level so you are not relying solely on platform-reported power for capacity protection.

References