Database/Firmware, BMC & network fabric
HPE iLO 4 / iLO 5 (remote buffer overflow): Remotely triggerable buffer overflow in the iLO firmware on both the Gen9
Impact
Remotely triggerable buffer overflow in the iLO firmware on both the Gen9 (iLO 4) and Gen10 (iLO 5) generations. Memory corruption on a service processor is the highest-value bug class in a fleet, because success means code on the BMC and therefore power control, Virtual Media, console, and an implant that persists across host reinstalls. Worth noting alongside the older iLO 4 authentication-bypass work that made this platform a known research target - the Gen9 tier tends to be the part of a fleet that stopped receiving attention.
Who can reach it
Reachable over the network to the iLO address on the out-of-band management VLAN.
What to do
Flash iLO 4 to v2.61b or later and iLO 5 to v1.39 or later. Out-of-band, per-node, no host reboot and no job drain. On Gen9 hardware the practical obstacle is inventory and change control rather than the flash itself - these are usually the nodes with the least recent firmware campaign. Interim control: hard-ACL the iLO management network.
References
Related entries
- Insyde InsydeH2O (PnpSmm shared SMM/non-SMM buffer, DMA TOCTOU): A buffer shared between SMM and non-SMM codeCVE-2022-32469 · Insyde InsydeH2O (PnpSmm shared SMM/non-SMM buffer, DMA TOCTOU)High
- Insyde InsydeH2O (FwBlockServiceSmm shared buffer, DMA TOCTOU): The firmware block service's shared buffer is racy, soCVE-2022-32470 · Insyde InsydeH2O (FwBlockServiceSmm shared buffer, DMA TOCTOU)High
- Insyde InsydeH2O (IhisiSmm / IhisiDxe command buffer): One representative of a family of roughly a dozen InsydeCVE-2022-32471 · Insyde InsydeH2O (IhisiSmm / IhisiDxe command buffer)High
- Insyde InsydeH2O (HddPassword shared buffer, DMA TOCTOU): Racy shared buffer in the ATA security driverCVE-2022-32473 · Insyde InsydeH2O (HddPassword shared buffer, DMA TOCTOU)High
- Insyde InsydeH2O (StorageSecurityCommandDxe shared buffer, DMA TOCTOU): The TCG/Opal security-command driver sharesCVE-2022-32474 · Insyde InsydeH2O (StorageSecurityCommandDxe shared buffer, DMA TOCTOU)High
- Insyde InsydeH2O (VariableRuntimeDxe shared buffer, DMA TOCTOU): Racy shared buffer in the UEFI variable driverCVE-2022-32475 · Insyde InsydeH2O (VariableRuntimeDxe shared buffer, DMA TOCTOU)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.